Nobody Can Exploit PHP on a Site That Does Not Run It: The Next.js Way Out of PHP2Shell

The attack needs a stranger, a POST request and PHP

Strip PHP2Shell to its working parts and three things must meet. An anonymous visitor sends a request, usually a POST with a multipart upload. A public web server hands that request to PHP. PHP, on an affected version, mishandles memory while parsing it, and under the right conditions the attacker's code runs. Wiz Research showed this against the official Docker images of WordPress, Drupal and Joomla. The application on top barely matters; Wiz says even a "Hello World" page on an affected PHP version can be exposed.

The patch breaks the third link. That is the right move today, and our emergency fix does it. But the second link is a choice, and most small business sites made it years ago without noticing: every page view runs PHP on a public machine. Take that link away and the next PHP flaw, whatever it is called, finds no interpreter on the other end of the wire.

The safest PHP on the internet is the PHP the internet cannot reach.

The fast path: WordPress stays, PHP leaves the front door

This is the easy integration, and it is easy for a specific reason: nothing your editors do has to change. We build a Next.js front end that reads your WordPress content through its REST or GraphQL API, pre-renders every page to plain HTML and serves it from Vercel's global edge network. Visitors get HTML. They never touch WordPress.

WordPress then moves behind the curtain as a private, headless content source. The admin sits behind a login allowlist or a VPN. No PHP endpoint answers the public internet. Your team still logs into the same dashboard, writes the same posts and presses the same Publish button, and the page updates on the public site. Your content, your URLs and your redirects come with it.

One thing does not change, and we will not pretend otherwise: the private WordPress still runs PHP, so it still gets patched. The difference is who can reach it. PHP2Shell needs an anonymous POST request to arrive at PHP. A server that answers only your editors and your front end does not take requests from strangers. The mechanics, including previews and plugins that stop drawing on the page, are in our guide to keeping WordPress as your CMS.

The full move: no PHP to patch, ever

The fast path leaves you running two systems. Some organizations want that, because their editors live in WordPress and a migration of habits costs more than a server. Many small businesses do not, and for them the cleaner answer is to retire WordPress. We replace it with Athena CMS, the content system we built and include with every custom site we make. Athena has no PHP in it anywhere.

Your pages, posts, products and images move into plain fields with a live preview, and every version is kept. The features that used to be plugins become part of the build. There is no plugin update to apply on a Friday afternoon, and no PHP release to wait for from your host. The move itself is described step by step at switching from WordPress to Athena, and the head-to-head is at Athena vs WordPress.

Three setups, side by side

Here is how a patched WordPress site compares with the two ways out. The first column is not a straw man: a WordPress site on PHP 8.4.27 is a perfectly respectable thing to own this week. The question is what owning it costs you the next time.

The first row is the whole security argument in one line. The longer version, row by row, is on our WordPress vs Next.js security page, and the fair case for each back end is in headless WordPress vs Next.js.

Your rankings, URLs and content come along

The objection that stops most owners is not the price. It is the fear of losing years of search rankings in a weekend. That fear is reasonable and the loss is avoidable. We keep your URLs and redirect every old one. Nothing is left to chance or to a plugin's default settings.

• Content. Every page, post, product, image and author carries over. On the fast path it never moves at all; Next.js reads it where it already lives.
• URLs. Addresses stay the same wherever possible, and every one that changes gets a permanent redirect, mapped one by one. Our redirect guide shows how.
• Search signals. Titles, descriptions, canonical tags and structured data are written into the new pages, not regenerated by guesswork. See migrating without losing SEO.
• Forms and integrations. Each form, booking widget and email hookup is listed during the audit and rebuilt in the new site, so nothing quietly stops sending leads.
• Plugins. Each plugin's job is written down and either built in, replaced or retired. A few turn out to do nothing but load; the full accounting is in WordPress plugins vs Next.js.

Next.js is not a force field

A sales page that claims invulnerability is a page you should close. So here are the limits, stated plainly. Moving off PHP removes this class of bug. It does not make a site immune to every other kind.

Next.js has had serious advisories of its own. In December 2025 the Next.js team published CVE-2025-66478, rated CVSS 10.0: a flaw in React Server Components that could allow remote code execution in unpatched App Router applications. It was nicknamed React2Shell, which tells you the security industry has found a naming convention it likes. The fix then was the same as the fix now: update.

Those updates are the job of our hosting and maintenance plans, which cover tested updates, off-server backups, security and uptime monitoring, with no long contract. The difference is that an update to a Next.js site is built and checked before it goes live, instead of applied to the live server and hoped about.

Patch today. Rebuild after.

A rebuild is not an emergency response, and we will not sell it as one. Your current site has to be safe while the new one is being made, so the order never varies. Nobody is left on a vulnerable PHP version while a designer chooses fonts.

1. 1

   Patch the current site

   PHP goes to 8.2.35, 8.3.36, 8.4.27 or 8.5.12, the site is tested and checked for signs of compromise. That is the emergency fix, and it comes first.

2. 2

   Audit what you have

   Every URL, form, plugin, integration and content type, written down, with a fixed-price quote for the fast path, the full move or both.

3. 3

   Build on a preview address

   The new front end, with private WordPress or with Athena, is built and compared page by page while the patched site keeps working.

4. 4

   Switch and lock down

   DNS moves, redirects go live, and WordPress is either closed to the public or retired. Search Console is watched for crawl errors afterward.

If your current site runs PHP 8.1 or older, step one is harder, because the PHP project ships no release for those versions. Our end-of-life PHP guide covers the stopgaps, and for many of those sites the rebuild is simply the cheaper way out.

Prices, financing and a free first look

Custom builds and rebuilds are a fixed price starting at $1,750. Sites with a store, a customer portal or a web app start at $3,500. We quote after a free audit, so the number reflects your site and not a guess. Financing is available for websites and for WordPress projects, and the broader menu is on our web design pricing page.

Still deciding whether to leave at all? Should I leave WordPress makes the case for staying, too. Or call (210) 346-0848. We are in San Antonio, Texas, and work with businesses across the US. The PHP2Shell hub has everything else about this week.