PopularLegacy PHP & WordPress modernization
PHP released fixes for two critical vulnerabilities on October 21, 2026. If your website runs on legacy PHP or an older WordPress setup, start with a free risk check. We’ll tell you where you stand in plain English, what to fix first, and how to get onto supported, patched versions.
01October 21, 2026
Serious, and fixable. For most sites the first step is a PHP update. That’s where we start.
On October 21, 2026, the PHP project released security updates for two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. PHP’s advisory says they can allow unauthenticated remote code execution: someone could run their own code on an unpatched web server without logging in.
PHP says every PHP installation serving web requests is at risk, and that only an update is a complete fix. PHP 8.1 and older no longer receive updates from the PHP project at all.
WordPress.org says the vulnerabilities are not specific to WordPress, and no WordPress update is required. What matters is the PHP version your server runs. In WordPress you can see it under Tools > Site Health > Info > Server, or ask your host.
Sources, as of October 21, 2026: PHP security advisory, php.net, GHSA-w8hw-w9fx-j79w (CVE-2026-109618), GHSA-6wmf-4rv5-p3rp (CVE-2026-109619), NVD: CVE-2026-109618, NVD: CVE-2026-109619, WordPress.org: Critical PHP Security Release, PHP supported versions.
02Sound familiar?
Your server runs PHP 8.1 or older, which no longer gets updates from the PHP project. Or nobody knows which version you’re on.
Core, plugins or the theme haven’t been updated in months, because something broke last time.
Its developer stopped shipping updates, and your site still depends on it.
The site was built by someone who has moved on, and the code is a mystery.
03How it works
Free. We look at your site, your platform and what we can see of your PHP and WordPress versions, and tell you where you stand and what to fix first.
Backups first. Then we update you to a supported PHP version and bring WordPress core, plugins and theme up to date, testing as we go so nothing breaks in front of customers.
You choose the path: a modern, well-maintained WordPress site, or an AI-native site built on React. We quote it up front.
We move your content, keep your URLs or redirect them, rebuild forms and integrations, and protect the search rankings you’ve earned.
Launch, then keep it current: updates, monitoring and quick edits, so you never end up here again.
04Where you end up
Stay on WordPress
Keep the CMS your team already knows, rebuilt on supported PHP with a clean theme and only the plugins you need.
Leave legacy PHP behind
A fast, modern site built on frameworks like React, with assistants like Claude built in. We migrate you from WordPress for you.
05Why Backbone
06Questions
It depends on which PHP version your server runs, how it is configured, and what runs on top of it. That is exactly what the free risk check is for. If you’d rather not wait, ask your host which PHP version your site uses and whether it is still supported.
WordPress runs on PHP, so it depends on your server’s PHP version as well as WordPress core, your plugins and your theme. Keeping all four current is what matters.
Usually not right away. The first step is often getting onto a supported, patched PHP version and updating what’s on top of it. A rebuild or migration comes next, when it makes sense for you.
Not if the migration is done carefully. We started out in 1996 as one of the first SEO firms, so we plan URLs, redirects and content before anything moves.
A modern site built on frameworks like React instead of a legacy PHP stack, with AI assistants like Claude built in where they help your visitors and your team.
The risk check is free. Upgrades and migrations are quoted up front, so you know the price before we start. Ongoing care can be part of a monthly retainer.
Update to 8.2.35 or newer now. Then plan your next move: php.net lists December 31, 2026 as the end of security support for PHP 8.2.
Yes. Stabilizing first and deciding on the bigger move later is a perfectly good plan.
That’s okay. We understand our limits. If what you need is bigger than, or different from, what we offer, tell us anyway. We’re happy to guide you toward offerings we know well that can get you the outcome you’re after.
Tell us your site and what worries you. We’ll reply with where you stand and a calm plan for what to do first.
PHP is a project of The PHP Group. WordPress is a trademark of the WordPress Foundation. Backbone Media is an independent agency and is not affiliated with or endorsed by The PHP Group, The PHP Foundation, the WordPress Foundation or Automattic.
Free PHP & WordPress risk check