Could Node.js and React be a safer, more modern home for your business website?
Two serious PHP vulnerabilities, known as PHP2Shell, have been found in PHP - the technology behind most WordPress, Drupal and Joomla websites. Fixes are available, but it has many business owners asking a bigger question: is our website still built on the right technology?
What is PHP2Shell?
PHP2Shell is the nickname for two serious flaws in PHP, officially CVE-2026-109618 and CVE-2026-109619. In the right conditions, they could let an attacker run their own commands on your web server - without needing a password. That could expose customer data, passwords and other sensitive information.
The PHP project released a PHP patch on 21 October 2026 (versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35), and says updating is the only complete fix. If your website runs on PHP, check with your developer or hosting provider that the update has been applied.
Why these PHP vulnerabilities are different
- It's in the engine, not a plugin. Researchers at Wiz showed attacks working on WordPress, Drupal and Joomla sites alike, exposing passwords, logins and system keys.
- Keeping your website updated wasn't enough. A fully up-to-date WordPress or Drupal site could still be exposed, because the problem sat in the server software underneath.
- AI is making attacks faster. Wiz found AI tools greatly reduced the time and skill needed to turn the flaw into a working attack - so platforms that are slow to update are becoming a bigger risk.
Is PHP still the right choice for your business?
When it comes to PHP security, PHP isn't unsafe by itself, and with regular updates a PHP site can be kept secure. The catch is the effort. A typical PHP website relies on PHP, a web server, a CMS, a theme and a long list of plugins - each looked after by different people, and each needing updates. Miss one, and your business could be exposed.
For a simple brochure site, that's manageable. But when your website handles customer accounts, online orders or connects to your accounting and stock systems, it pays to have a platform built specifically for the job.
Node.js: a modern PHP alternative for business
Node.js powers the "back end" of a website or app - the logins, orders, data and connections to your other systems. It's used by companies such as Netflix, PayPal and LinkedIn.
- Built for your business. We build only what you need, instead of bolting plugins onto a CMS. Less code means fewer things to go wrong.
- Problems stay contained. Logins, pricing, orders and payments can run as separate parts, so one can be updated without touching the rest.
- Security from day one. Two-step login, single sign-on, access controls and Cloudflare firewall protection are built in, not added on.
- Fewer outside components. No technology is completely free of security issues, but a small set of trusted, monitored components is far easier to manage than dozens of plugins.
Where React fits in
React, created by Meta, builds the screens your customers and staff use. Node.js does the work behind them, and the two talk through secure connections called APIs.
- A protective layer. Your public website never talks directly to your business systems - every request is checked first, like a reception desk in front of your office.
- Fast and mobile-friendly. React sites feel quick and app-like, and perform well on Google's Core Web Vitals, which helps your search rankings.
- Easy to grow. Reusable building blocks keep your platform consistent as your business expands.
Like any technology, React gets security updates too. Real protection comes from secure design, prompt updates and ongoing monitoring - exactly what we provide.
PHP vs Node.js and React at a glance
| Traditional PHP website | Node.js + React platform | |
|---|---|---|
| How it's built | A CMS extended with plugins | Purpose-built around your business |
| Adding features | Install more plugins | Build exactly what's needed |
| Connecting to other systems | Plugins or custom add-ons | Designed in from the start |
| Logins and access | Usually plugin-based | Two-step login, single sign-on and access controls |
| Ongoing upkeep | PHP, CMS, theme and every plugin | A smaller, controlled set of components |
| Best suited to | Content-focused websites | Portals, trade stores and business apps |
Move to a modern platform with Koda Web
Koda Web helps businesses across New Zealand and Australia move from PHP websites to purpose-built Node.js and React platforms. You get a platform built around your business, security designed in from the start, a faster experience for your customers, seamless connections to your other systems, and ongoing care from a local team.
Is your website ready for what comes next? Talk to the Koda Web team about moving your business platform to Node.js and React.
Frequently asked questions
Are WordPress and Drupal websites affected by PHP2Shell?
Yes. Every WordPress site runs on PHP, so if the WordPress PHP version on your server hasn't been patched, the site can be exposed to these PHP vulnerabilities. Updating WordPress, Drupal or their plugins doesn't fix it on its own - PHP itself must be updated.
Is Node.js more secure than PHP?
No technology is completely free of security issues. But a purpose-built Node.js platform has fewer moving parts and security built in from the start, making it easier to keep secure and quicker to fix.
What's the difference between Node.js and React?
Node.js runs on the server and does the work behind the scenes. React builds the screens your customers and staff see. Together, they make a complete modern web platform.
Should I move my PHP website to Node.js and React?
If your website has become an important business tool - with customer logins, trade pricing or system connections - it's well worth considering. Talk to Koda Web and we'll help you find the right path.