Is It Time to Move Away from PHP?

Why the recent PHP vulnerabilities matter

On 21 October 2026, the PHP development team released security updates addressing two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. Under certain conditions, these flaws could allow an unauthenticated attacker to execute malicious code on an affected server.

In practical terms, this is more than a website displaying an error or behaving unexpectedly. Successful exploitation could allow an attacker to run code on the server, potentially putting website data and other systems at risk.

The UK's National Cyber Security Centre has urged organisations to identify systems running PHP and apply the relevant security updates. If a system cannot be secured promptly, organisations should assess the risk and consider taking it offline until the issue can be mitigated.

Read the NCSC's official PHP security guidance.

PHP is widely used to power websites and web applications. W3Techs reported that it was used by 69.2% of websites with a known server-side programming language on 29 October 2026. That makes this a significant issue for website owners, although the statistic should not be taken to mean that every PHP website has been compromised.

The immediate priority is to check whether your website or hosting environment is affected and ensure the appropriate security updates have been applied.

Updating PHP is only part of the picture

For a well-maintained website, applying a security update may be relatively straightforward. The hosting provider may handle the server-side update, or a developer may be able to update the relevant components and test that everything continues to work.

Older websites can be more complicated.

A site might depend on an outdated PHP version, plugins that are no longer maintained, or custom code written for an older environment. Updating the underlying software can expose compatibility problems that have gone unnoticed for years.

This can leave businesses facing a difficult choice. They may need to invest time and money in making the existing website compatible with supported software, while still carrying the burden of maintaining an ageing system.

The problem is not necessarily PHP itself. It is the condition of the website, the software it depends on and whether it can be maintained reliably.

Security updates address known vulnerabilities, but they cannot resolve every underlying maintenance problem.

Should you patch, modernise or rebuild?

There is no single answer for every website. The right approach depends on the existing system, its business purpose, its dependencies and the cost of maintaining it.

1. Update and maintain the existing website

If the website is in good condition and its dependencies are supported, updating PHP and applying the relevant security fixes may be all that is needed. This is often the most practical option when the existing system continues to meet the business's needs.

2. Modernise the existing system

If the website has accumulated outdated dependencies or compatibility problems, a more substantial programme of updates and refactoring may be worthwhile. This can improve maintainability and make future security updates easier to manage without replacing everything at once.

3. Rebuild the website

Sometimes the cost and risk of maintaining an old system begin to outweigh the benefits. If the code is difficult to understand, key components are no longer supported, or routine changes regularly cause problems, rebuilding may be the more sensible long-term investment.

A rebuild also provides an opportunity to address wider issues with performance, accessibility, mobile usability and the customer journey. Rather than simply recreating the old website, you can reconsider how well it supports the business today.

4. Move away from PHP

For some businesses, a rebuild is an opportunity to move to a different technology stack. Depending on the requirements, that could mean using a modern .NET application, a JavaScript-based solution or another suitable platform.

Changing languages alone does not guarantee better security. The replacement still needs to be designed, deployed and maintained properly. The goal should be a system that fits the business, can be supported over time and does not leave the organisation dependent on technology it struggles to maintain.

Don't wait for the next security issue

The recent PHP vulnerabilities are a timely reminder that software maintenance is an ongoing responsibility, not a one-off task when a website launches.

Businesses should know what their website runs on, which components it depends on, who is responsible for applying updates and what happens when a security issue is discovered.

If your website is built on an older PHP stack, now is a good time to review its condition. That does not automatically mean replacing it. It means understanding the risks, the available options and the likely cost of each approach before a problem forces the decision.

At Sheldon Software, we help businesses assess existing websites and applications, identify technical issues and plan practical improvements. Whether your site needs security and compatibility work, a more substantial modernisation programme or a complete rebuild, the first step is understanding what you have and what your business needs.