PHP2Shell: When moving away from WordPress makes sense

PHP2Shell makes a PHP security update urgent for affected WordPress websites. For a company already paying for plugin licenses, update support and repairs, it also brings an ongoing expense back into view: how much work does this website need just to keep running?

A business website has a job to do. It should present your services well, make your experience credible and help the right customers get in touch. If maintaining it keeps taking time and budget away from that job, the setup deserves a closer look.

webvise rebuilds WordPress business websites with their content, search visibility and contact paths in mind. This article explains the immediate PHP2Shell update, when a move is worth considering, and what a WordPress migration with webvise actually includes.

• Have your host apply the security fixes now; a rebuild is a separate project.
• Compare the full cost of your current site, including licenses, support and your own time.
• A worthwhile migration should simplify upkeep while preserving the content and functions your business uses.

What PHP2Shell means for your WordPress website

On October 21, 2026, the PHP project released fixes for two critical security flaws, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. They can allow attackers to run code on an affected server. PHP powers WordPress, so the hosting software needs attention even when WordPress and its plugins are current. Official PHP security notice.

Ask your hosting provider to confirm that both fixes are active on your live website and any test sites. The first fixed releases are:

Some providers apply the fixes to an older package. In that case, ask for their security notice confirming both fixes. PHP supplied exceptional source patches for 7.4, 8.0 and 8.1 too, but those versions remain outside regular support. Your provider should confirm the installed fix and plan any required version upgrade.

Get that update handled first. Once your provider confirms it, the longer-term question is what you want to keep paying to maintain.

Security information checked on October 22, 2026. The PHP advisories contain the technical details, including the second vulnerability.

The maintenance bill goes beyond hosting

A hosting invoice only shows part of the cost. For a WordPress site, the total can also include premium plugins, theme licenses, update support, compatibility fixes and the time someone spends coordinating all of it. Add the last twelve months of those costs before judging whether your website is inexpensive.

Then look at what that spending achieved. Did the website gain better service pages, stronger references or a clearer inquiry process? Or did most of the work keep the existing site functioning? Both consume budget, but only some of that budget improves what a potential customer sees.

For a business that mainly needs service pages, project references and a contact form, a large collection of plugins can be difficult to justify. The useful comparison is the cost of maintaining the current setup against the cost of rebuilding the functions you actually need.

What webvise changes in a WordPress migration

webvise starts with your existing pages, plugins, forms and editing needs. Each function gets a decision: keep it, replace it or remove it because the business no longer uses it. That work defines the scope before the new website is built.

The rebuild uses Next.js, with a focus on fast pages and fewer separate plugins to maintain. When WordPress and PHP are fully removed, their updates and plugin licenses leave that application's maintenance plan. The new website still needs software updates and support; who handles them and what they cost belong in the offer.

• A website that presents your business properly. Services, references and contact options get a clear structure, with layouts that work on phones.
• Performance you can check. webvise targets a PageSpeed score of 90+ and tests the finished pages before launch.
• An editing process your team can use. Agree how staff will change text, publish references and add pages, including when they need support.
• Working inquiries and integrations. Contact forms, booking tools and other connections form part of the migration scope.

One example is a website relaunch for a German construction firm. The new site brought together project references, company news and service information in German and English. Its documented Lighthouse performance result was 95 out of 100. The project shows that a business website can carry substantial content and useful features while loading well.

For your website, the starting point is its current condition. A WordPress migration assessment looks at the pages and functions worth keeping, the maintenance work that can be removed, and the effort needed to make the move.

What happens to your Google rankings and existing content?

The work already invested in your website belongs in the migration plan. webvise inventories the existing URLs, keeps useful content and metadata, and maps redirects for addresses that change. Search rankings can move during a migration, so the launch includes checks and monitoring.

Forms need the same care. An inquiry must reach the right inbox after the switch, and a booking or CRM connection must still do its job. These are items to test before launch, alongside the pages themselves.

You also decide how content will be edited after the move. A team that publishes daily needs a different workflow from a company that updates its service pages a few times a year. The WordPress migration FAQ covers content, editing, integrations and project scope.

When is it worth moving away from WordPress?

A migration is worth discussing when your current website repeatedly costs time without getting better. Recurring repair bills, slow pages, unused paid plugins and difficult content changes are concrete reasons to review it. Bring those issues to the conversation, along with the features your team depends on.

A business with a complex WooCommerce shop or a large editorial team needs a closer look at its workflows and integrations. A well-run WordPress setup can still fit those needs. PHP2Shell calls for a security update everywhere it applies; the business case for a rebuild comes from the website's ongoing costs and limitations.

Send webvise your website URL and what currently gets in the way. That gives the first conversation a concrete starting point: what can stay, what should change, and what a migration would need to cover. You can then compare a scoped rebuild with the cost of continuing as you are.