This post is for anyone running a PHP powered website that’s more than a couple of years old.

PHP powers around 70% of websites & PHP code is behind many web apps & services - like Nextcloud & Moodle.

So why am I specifying PHP & “more than a couple years old”?

The Brave New World of AI Powered Security Vulnerabilities

On the 20th of October 2026 an exploit called PHP2Shell was announced that impacted virtually every PHP-powered website & application on the internet. PHP2Shell allows attackers to run their own software on unpatched servers, effectively taking control of them. It was discovered using AI, but at least it was discovered by the “good guys”, who could develop a fix.

Common PHP frameworks include WordPress, Laravel, Drupal, Joomla & Silverstripe. But this isn’t just a PHP problem, this is an everything problem. PHP2Shell was only one of several security vulnerabilities that were announced that week - impacting a range of internet technologies.

Official patches for PHP2Shell were quickly rolled out for every version from PHP 8.2 - originally released in December 2022.

Many websites & applications built using PHP before December 2022 are on an older version of PHP, without an official patch. Even websites built after PHP 8.2 was released may be using older versions.

Simple Fixes Often Aren’t Remotely Simple

Unfortunately, the seemingly simple solution of upgrading PHP is often a lot more complex than it seems at first glance.

An example website:

• Operating System: Ubuntu 18.04 LTS
  Ubuntu 18.04 LTS released in April 2018 & support finished in May 2023.

• Software Language: PHP 7.2
  PHP 7.2 released in November 2017 & support finished in November 2020.

• Framework: Drupal 8.9
  Drupal 8 released in November 2015 & support finished in November 2021.

• Dependency: Symfony 3.4
  Drupal 8 is built on the Symfony framework. Symfony 3.4 released in November 2017 & support finished in November 2021.

You might have noticed that every version of software is out of support. This means they are not actively receiving security updates, in an environment where ever growing AI-powered automated security attacks prey on unpatched machines.

In this example even a short term upgrade to PHP 8.2 (which itself goes out of support at the end of 2026) sets off a domino effect of upgrades. Drupal 8 depends on Symfony 3, which can’t run on PHP 8. The current version of Drupal (11) runs on PHP 8.3, which would require a server upgrade.

The whole process of upgrading software across multiple major software versions often leads to a complete rebuild - not a quick or low cost undertaking.

The Rock & The Hard Place

Everyone with websites running on old software is stuck between a rock & a hard place.

On one hand the “bad guys” can now gain access to the servers running the websites via unpatched software.

On the other hand, having to completely rebuild your website is costly & time consuming.

Avoiding Costly Rebuilds

Yes, I run a software development agency & I’m here to encourage you to spend less on software development.

#1 Website Design has Barely Changed in a Decade

The evolution of website design has slowed dramatically & a 10 year old website should still look relatively modern & work across all devices (phones etc.)

#2 AI Coding Agents are Here to Help

Software development is one of the first industries to experience the AI revolution. While some of its capabilities are overblown, AI coding agents are very good at replicating existing design & functionality.

#3 Maintenance & Ongoing Improvement

Pro-active website maintenance has substantially grown in importance over the past few years. It’s no longer a case of building a website & leaving it to gradually disintegrate, before building a replacement website a few years down the track. A far more practical approach is to monitor & maintain your website, while making small improvements over time.

With all of these in mind I’m often recommending replatforming over rebuilding for older websites. If the website looks fine & works fine, but is vulnerable to cyber attacks then why not “lift & shift” your website to a new platform that has better security & can be maintained going forward?

What the Heck is “Replatforming”?

A “platform” is tech jargon for the stack of technology your website or application runs on.

AI Coding Agents allow us to copy the design & functionality of an existing website or application & apply it to a modern platform.

This removes a massive amount of work compared to a complete rebuild - days or weeks vs months.

If you’re happy with your current website, but worried about security, a replatform paired with a maintenance plan is the way to go.

We’re Here to Help

We’ve had great success replatforming older websites onto modern platforms. Not only does it dramatically increase security, but our clients find the modern platforms a lot easier to use.

If you’ve got concerns about your website & would like a no obligation chat - please get in touch.

---

Banner Photo by Jono Hirst