PHP2Shell CVE-2026-109618 / 109619 · WordPress and Drupal hosts should update PHP now.

Patch guide for your host
DrupalMigration.aiPatch tonight. Migrate to modern, AI-improved.

Patch tonight. Migrate to modern, AI-improved.

Glossary

Last updated: 2026-10-23 · Shawn Gants

PHP2Shell

The name used on this site for CVE-2026-109618 and CVE-2026-109619, two critical flaws in PHP itself, fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 (php.net). Updating Drupal or WordPress does not fix them. The PHP2Shell guide has the longer version.

Custom post type

A WordPress content type registered in addition to the built-in types post, page, attachment, revision, and menu (WordPress developer docs). Products, events, and staff profiles are common examples. They are in scope for a WordPress migration.

Advanced Custom Fields (ACF)

A WordPress plugin that adds custom fields to edit screens (ACF documentation). The values move into Postgres columns. Repeaters and flexible layouts are mapped in the audit.

Row-level security

Postgres policies that decide, inside the database, which rows a user can read or change (Supabase). Member areas on the new site use this instead of a PHP permission layer.

301 redirect

A permanent redirect from an old URL to the new one. Every public Drupal or WordPress URL in the audit gets one. It is how existing links keep working. It is not a promise that rankings stay the same.

WooCommerce

The open-source ecommerce plugin for WordPress (WooCommerce on WordPress.org). Catalogs, carts, orders, and extensions are quoted. The entry point is the $499 audit, credited toward the project. It is not the $999 standard tier and it is not the overnight tier.

Yoast SEO and Rank Math

WordPress plugins that store an SEO title and meta description on content (Yoast SEO, Rank Math). When those values are present, the migration copies them. Plugin-printed schema is replaced by reviewed JSON-LD on the new templates.

Standard, emergency, and complex

The three migration tiers. Standard is from $999. Emergency overnight is $4,999 for a site that is down and is not a complex rebuild. Complex work, including WooCommerce, starts with a $499 audit credited toward the project. Page count is not a price. Details are on the pricing page. There is no emergency PHP patching service.

Sources on this page

  1. S02: php.net News Archive 2026: Security advisory + 8.5.12/8.4.27/8.3.36/8.2.35 release notes
  2. S24: Supabase Docs: Row Level Security
  3. S59: WordPress developer docs: Registering custom post types (post, page, attachment, revision, menu)
  4. S60: Advanced Custom Fields: Resources (custom fields on WordPress edit screens)
  5. S61: WordPress.org plugin directory: Yoast SEO (on-site SEO titles and meta descriptions)
  6. S62: WordPress.org plugin directory: Rank Math SEO (SEO titles and meta descriptions)
  7. S63: WordPress.org plugin directory: WooCommerce (open-source ecommerce for WordPress)