In October 2026, the PHP project announced two critical security vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Attackers may be able to break into a website without logging in, and read or change its files and database.
PHP 8.2 and later have official fixes. However, many business websites still run on end-of-life versions such as PHP 7.x or even 5.x. These versions have no official fix, and they are unlikely to get any fix for future vulnerabilities either.
Why old websites are hard to upgrade
Many websites were built years ago and have not been updated since, and the original developers no longer maintain them. When these websites are switched to a new PHP version, they stop working because they use old features that have been removed. Rebuilding a website takes a lot of time and money, so these websites are left on old versions.
Updating website code with minimal changes
To address this, Nethub has launched a website code update service:
- We review the website code and list what needs to be changed for the new PHP version.
- We only change the parts that do not work with the new PHP version. The website design and content stay the same.
- We test in a test environment first, and only apply the changes to the live website once they work.
- We provide a change record and back up the website before applying the changes.
The service covers custom-built PHP websites as well as older versions of website systems such as WordPress, OpenCart and Joomla. The website does not need to have been built by Nethub.
Available now
For details, see our PHP Upgrade Service for Old Websites page, or request a quote.
