Why We Build Websites with Next.js – and What WordPress Owners Should Check Now

In late October 2026, the PHP team released security updates for two critical flaws: CVE-2026-109618 and CVE-2026-109619, known in the press as "PHP2Shell". According to security reports, both can allow remote code execution on the server without authentication. Since WordPress runs on PHP, this affects many business websites.

This article puts it in perspective, without panic: what happened, what you should check now, and why we build websites with Next.js instead of WordPress – including the weaknesses Next.js has.

What happened?

• These are two flaws in PHP itself, not in WordPress or a specific plugin.
• According to reports, the patched PHP versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For older branches, hosting providers or Linux distributions sometimes ship backports.
• Details leaked before the official release, and an exploit tool is reported to be circulating. It makes sense not to wait weeks.
• Whether your website is affected depends on the PHP version of your hosting, not on whether your WordPress is up to date.

What you should check now

1. Find out your PHP version. In WordPress under Tools → Site Health → Info → Server, or in your hosting provider's customer area.
2. Check whether your host has patched. Ask in writing whether the fixes for CVE-2026-109618 and CVE-2026-109619 are in place (with distribution backports, the displayed version number does not necessarily change).
3. Retire outdated PHP versions. PHP 7.x and older no longer receive official updates; the only fix is moving to a supported version.
4. Make sure you have current backups – stored off the server, with a tested restore.
5. Update plugins, themes and WordPress core, and delete unused plugins rather than just deactivating them.
6. Look for anomalies: unknown admin accounts, new files in wp-content/uploads, unusual redirects or spam pages in Google.
7. Review credentials: admin passwords, FTP/SSH, database – change them if in doubt.

If you are unsure about the state of your website: get in touch and we will take a look.

Why we build websites with Next.js

• Smaller attack surface in operation. With WordPress, every single plugin, theme and template is code from changing authors and therefore a potential security hole. On top of that come WordPress itself, the database and, as in the current case, PHP as the runtime. Each of these layers must be kept up to date permanently, and a flaw in just one of them is enough. A publicly reachable admin login is also a constant target. Our sites are mostly generated at build time and delivered as finished files. There is no plugin landscape and no public admin login on the frontend. Fewer layers mean less to maintain and less to attack.
• No PHP. Flaws like PHP2Shell do not affect our stack.
• Fast load times, which matter for users and search engines.
• Updates through pinned dependencies that we roll out in a controlled way, instead of dozens of plugins from different authors.

The weaknesses of Next.js – stated openly

Next.js is not "secure by definition". In December 2025, React2Shell (CVE-2025-55182) became known: a critical flaw in React Server Components that also affected Next.js projects and was actively exploited. It has been patched – but anyone who does not apply updates stays vulnerable. In addition:

• Dependence on an update rhythm. Next.js and React need regular updates; a project that is never touched after launch goes stale.
• More development effort than a WordPress site builder if you want to edit content without a developer (this needs a headless CMS or maintenance by us).
• More complex infrastructure once server-side features (forms, login, database) are added.

The difference is less "secure" versus "insecure" and more how small the attack surface is and how consistently it is maintained. The same applies to WordPress.

Conclusion

Check your PHP version this week and ask your host about the patch. If you are considering moving your website to a modern stack, talk to us.