October 22, 2026
Emergency response and migration for WordPress sites affected by the PHP vulnerabilities
Following the PHP security release of October 21, 2026 (CVE-2026-109618, CVE-2026-109619), we are accepting requests for emergency response and site migration from companies running WordPress.
These vulnerabilities are not fixed by updating WordPress; PHP must be updated on the server. No fix is provided for PHP 8.1 and older.
We offer first response from the day you contact us, and migration to a static site or microCMS in as little as 5 days.
- First response
- Same day
- Static migration
- From 5 days
We are an official microCMS partner
Vulnerability Summary
- CVE
- CVE-2026-109618, CVE-2026-109619
- Severity
- CVSS v4.0 9.2 (Critical), risk of remote code execution
- Affected
- All PHP running on web servers (PHP-FPM, Apache mod_php, CGI, LiteSpeed, etc.)
- Fixed in
- PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 (released Oct 21, 2026, 14:00 UTC)
- PHP 8.1 and older
- No official fix is provided
Source: PHP News Archive, IPA (Japan)
Before and After
Before (WordPress)
PHP, WordPress and a database run on the public server
PHP handles every request, so vulnerabilities in PHP, WordPress or plugins apply.
After (static site / microCMS)
Only HTML and images on the public server
No PHP runs on the public server, so PHP vulnerabilities do not apply. Content is edited in microCMS.
What We Offer
Static site
Pages are exported as HTML and served from a CDN. With no PHP or database on the public server, PHP vulnerabilities do not apply. Suited to rarely updated corporate, recruiting and landing pages.
microCMS
Content is edited in microCMS and published as static pages. Suited to sites that post news or blogs in-house. WordPress posts and media are migrated in bulk.
Continue with WordPress
For plugin-heavy sites, we restrict admin access, update PHP and WordPress, and set up an update process.
Official microCMS Partner
We are an official microCMS partner and have handled many WordPress-to-microCMS migrations, using tooling we developed ourselves.
Static Migration Schedule (Fastest Case)
Day 0
Version check, backup, removal of unused plugins
Day 1
Inventory of hosting, maintenance and forms; migration plan
Days 2–4
Page export, design reproduction, content migration, form replacement
Day 5+
Launch, redirects from old URLs, shutdown of PHP on the old server
* Assumes access to the server and WordPress admin. Timelines vary with site size and features.
FAQ
- What does it cost and how long does it take?
- It depends on pages, posts and forms. A static migration of a rarely updated site takes as little as 5 days; a microCMS migration of a typical corporate site takes 1–2 months. We quote after reviewing your site.
- What happens to our contact form?
- We rebuild it without PHP. Recipient addresses and auto-replies carry over. Many forms may take more than 5 days.
- Will our URLs change?
- We keep existing URLs in principle and set redirects for any that must change.
- Can you work on a site built or maintained by another company?
- Yes, with access to the server and WordPress admin. We can also share the work with your current maintainer.
Individual Areas
Related Services
Contact
Emergency response and migration for WordPress sites
We can start by sorting what to do first. We run businesses ourselves, so the conversation stays about labor and ops. Consultation and estimates are free.
Online meetings / reply by next business day / free consult & estimate
01
Talk to us
Via the form or online. Requirements do not need to be fixed.
02
Hearing
We learn how you work today and sort out where to start.
03
Plan and quote
We propose scope, timeline, and cost. Free up to this point.