Frequently asked questions

PHP2Shell

What is PHP2Shell?

Two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. They allow unauthenticated remote code execution on servers running affected PHP versions. Both are rated CVSS v4.0 9.2 (php.net).

How do I fix PHP2Shell?

Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your vendor's patched package, then restart PHP (php.net).

Does updating Drupal fix PHP2Shell?

No. The vulnerability is in PHP, not Drupal (Drupal PSA-2026-10-20).

Is PHP2Shell being exploited?

AWS reported broad exploitation in the wild, with a first attempt on Oct 17, 2026 (AWS). Cloudflare observed attack traffic (Cloudflare).

My host says I'm on PHP 8.3.6. Am I vulnerable?

Maybe not. Distributions often backport fixes without changing the version number (Ubuntu 24.04's patched package still reports 8.3.6) (Tag1). Ask your host to confirm in writing.

I can't update today. What can I do?

Apply PHP's temporary measures (they reduce but don't remove risk), put a WAF in front, or take the site offline until it's patched (php.net, CISA).

Should I change passwords?

On servers that ran an affected version and were reachable from the internet: yes, rotate database passwords and API keys (Tag1).

Drupal end of life

When does Drupal 10 reach end of life? December 9, 2026 (Drupal.org).

When did Drupal 7 reach end of life? January 2025 (Drupal.org).

When is Drupal 12 released? The week of December 7, 2026 (Drupal.org).

What PHP does Drupal 11 need? PHP 8.3 or newer (Drupal.org).

When does PHP 8.2 reach end of life? December 31, 2026 (php.net).

WordPress

Does the PHP check apply to WordPress?

Yes. WordPress runs on PHP. The requirements page recommends PHP 8.3 or greater. The version check compares the version string you paste. It does not contact your server.

Why move from WordPress to Next.js?

Plugin updates, PHP exposure, and a host you keep patching. The WordPress migration page covers those reasons without a made-up vulnerability count. The guide lists what moves.

What WordPress content do you migrate?

Posts, pages, custom post types, Advanced Custom Fields, media, users, forms rebuilt in React, 301 redirects, and SEO titles and descriptions saved by Yoast SEO or Rank Math. WooCommerce is quoted. See the glossary.

Is there an emergency PHP patch for a down WordPress site?

No. There is no emergency PHP patching service. A down site that is not a complex rebuild can be an overnight migration at $4,999. Your host still owns the PHP update.

Migration

What do you migrate Drupal or WordPress to? Next.js 16 (React + TypeScript, Tailwind CSS, shadcn/ui), Supabase (Postgres, Auth, Storage, row-level security) and Netlify (deploys from GitHub on every push to main). Drupal migration. WordPress migration.

Does migrating make my site unhackable? No. It removes the PHP server from your stack, but React/Next.js have had critical CVEs too (React). You still need updates. Our care plan handles them.

What is row-level security? Postgres policies that decide, inside the database, which rows each user can read or change (Supabase).

Will I keep my SEO? Every old URL gets a 301 redirect to its new address, and we resubmit your sitemap. No one can guarantee rankings.

Can members keep their accounts? Yes. Users are migrated to Supabase Auth. The password approach (reset vs rehash at first login) is decided at audit.

Do you patch PHP for clients? No. Your host or system administrator updates PHP. The version check and the patch guide are information, with the sources on those pages.

How much does a migration cost? Standard is from $999 (as low as $999). The quote rises with custom functionality, member logins and user data, and integrations. We do not price by page count. Emergency overnight migration is $4,999 when the site is down and is not a complex rebuild. Complex or enterprise work is a custom quote after a $499 audit, credited toward the project. Optional AI features for the new site are quoted separately and have no published price. See pricing.

AI-improved migration

Do you only port the Drupal site?

No. The migration includes an AI-assisted improvement pass: content audit and cleanup, rewrites for clarity, structured data, alt text and accessibility fixes, information architecture, and internal links. A person reviews every change. Details are on AI-improved migration.

Are AI results guaranteed?

No. Rankings, AI citations, accessibility certification, and speed scores are not guaranteed. Human review is required on the audit, the copy, the schema, and the code.

What optional AI features can the new site have?

Site search or a Q&A assistant over your own content, smart forms, and personalization. Those are add-ons. The price is quoted. They are not included in the $999 migration.

How long does it take? An emergency rebuild for a down site is overnight. Other dates are in the quote.

Do you only work in Spokane? No. We're Spokane-based and work remotely anywhere.