Your PHP app shouldn't beone CVE from disaster.
This week PHP shipped fixes for two critical flaws that let attackers run code on your server without logging in. If your application is stuck on PHP 8.1 or older, there is no official fix. We'll help you patch what you can today, then move your application to a modern stack without a risky big-bang rewrite.
Two critical flaws, no login required
On 21 October 2026 the PHP project released fixes for CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 (critical) on CVSS v4.0 and can allow unauthenticated remote code execution.
The PHP project's advice is blunt: there are no complete mitigations, and updating is the only safe choice.
Fixed in 8.3.36, 8.4.27 and 8.5.12. Upgrade to those releases now.
Fixed in 8.2.35, but 8.2 reaches end of life on 31 December 2026. After that, no more security fixes.
These versions no longer receive updates from the PHP project. Unless your vendor backports patches, you stay exposed.
Patch today, plan tomorrow
Migration is a project. Exposure is an emergency. Before we talk about a new stack, make sure you've done these. If you can't do them because your application won't run on a supported PHP version, that's your sign that it's time to move.
Signs your PHP app needs more than a patch
The vulnerability isn't the real problem. The real problem is an application that can't take the fix.
Stuck on an old PHP version
The app breaks on anything newer than 7.x or 8.1, so every security release is one you can’t install.
Abandoned framework
Built on Zend Framework 1, CodeIgniter 2, Symfony 2 or a home-grown framework that nobody maintains any more.
Nobody wants to touch it
No tests, SQL in templates, and a team that is afraid to change anything in case it breaks.
Hard to hire for
You can’t find developers who want to work on it, and the people who know it best have left.
A migration that never takes you offline
Big-bang rewrites fail because the business can't stand still for a year. We replace your PHP application piece by piece while it keeps serving customers.
Assess
We audit your codebase, infrastructure and data. You get a written report covering your exposure, what the app actually does, and a recommended path, even if that path is “just upgrade PHP”.
Stabilise
We patch or containerise the current system so it’s safe while we work, and add tests around the behaviour that matters most to your business.
Migrate in slices
Using the strangler pattern, we move one feature at a time to the new stack behind the same URLs. The old and new systems share the same data, so there’s no big-bang cutover.
Switch off PHP
When the last route has moved, we retire the PHP application and hand over a documented, tested codebase your team can own.
A modern stack your team can own
We typically move PHP applications to TypeScript end to end: a Next.js and React front end, a typed API, and a managed PostgreSQL database, deployed through automated pipelines. We pick the stack that fits your team and your hosting, not the one that's fashionable.
Technologies we use
Common questions
Do we have to rewrite everything at once?
No. We migrate feature by feature, with the old and new systems running side by side. Your users keep working throughout, and each slice goes live as soon as it’s ready.
Can we keep our existing database?
Usually, yes. Most migrations keep the existing MySQL or PostgreSQL data in place and move it later, if at all. We only change the database when there’s a clear reason to.
What if we only need to upgrade PHP?
Then that’s what we’ll recommend. If your app can move to a supported PHP 8.x release with reasonable effort, upgrading in place is often the cheapest and safest option. The assessment is there to find the right answer, not to sell a rewrite.
Is my WordPress or Drupal site affected?
Yes, if it runs on an unpatched PHP runtime. These flaws are in PHP itself, so updating WordPress or Drupal doesn’t fix them. Your server or host has to run a patched PHP release.
Why move away from PHP at all?
Modern PHP is a capable language. The risk comes from applications that are stuck on old versions or unmaintained frameworks. If yours is one of them, moving to a modern TypeScript stack gives you a larger hiring pool, a single language across front end and back end, and a codebase that can keep up with security releases.
Find out where your PHP app stands
Tell us about your application. We'll reply within 24 hours and help you work out whether you need a patch, an upgrade or a migration.
Book a migration assessment