Scared to touch your Drupal site?Start fresh before the next PHP exploit

PHP security problems keep coming. This might be the final straw.

Drupal runs on PHP, so every serious PHP or Drupal security issue lands on your desk: update core, update modules, check that nothing broke. For a big organization with developers, that's normal. For a small business with a simple site, it's a lot of upkeep for a few pages.

If that's you, move your site over before it becomes a problem.

WebZum sites are static pages served from AWS. No PHP, no WordPress. You never install plugins or run updates.

Free to see, pay to publish. Sign up and WebZum builds your new site in minutes. Look at it free for 30 days. Publishing costs $19/mo, with a 30-day money-back guarantee.

Signup required. 30-day money-back guarantee. No contract.

Is WebZum the right Drupal alternative for you?

Be honest with yourself here. Drupal is often chosen for large, complex sites: lots of content types, user logins, custom workflows, integrations.

• Good fit: a local business or small organization whose Drupal site is really a brochure. Services, about, team, contact, hours, photos, a blog.
• Not a fit: sites with member logins, complex custom content, or deep integrations. Talk to a Drupal developer instead.

Drupal 7 end of life, and why Drupal means PHP

Drupal 7's security support ended on Jan 5, 2025. Drupal.org says that, from that date, it gets no more security or compatibility updates (Drupal 7 End of Life). Still on Drupal 7? Your choices are a migration to modern Drupal, paid extended support, or a move off Drupal.

Modern Drupal is PHP software too. Drupal 11 needs PHP 8.3 or newer, and Drupal 12 needs PHP 8.5 (Drupal PHP requirements). The PHP project only patches each version for a set time (PHP supported versions).

Serious holes do happen. In 2018, "Drupalgeddon 2" (CVE-2018-7600) let remote attackers run code on unpatched Drupal sites, and NVD rated it 9.8 Critical (NVD). In 2024, CVE-2024-4577 hit PHP itself on some Windows setups, also rated 9.8 (NVD).

The latest example (Oct 2026)

On Oct 21, 2026, the PHP team released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical flaws, CVE-2026-109618 and CVE-2026-109619 (php.net advisory). CISA, the federal cybersecurity agency, calls them "php2shell."

What it is, in plain English: in the worst case, someone on the internet could send your server a request and run their own code on it, without logging in. That's what "unauthenticated remote code execution" means. The bug is in PHP itself, not in any one CMS, so it matters for any site running PHP to serve web pages. The PHP team says the risk is highest on Apache with mod_php.

The proof:

• PHP team: "All PHP users are strongly encouraged to update immediately." Only an update is a complete fix (php.net).
• CISA (Oct 21, 2026): "CISA strongly urges organizations to immediately patch" both flaws and update to the fixed versions (CISA alert).
• NVD: both rated 9.8 Critical (CVE-2026-109618, CVE-2026-109619).
• NSA Cybersecurity posted on X the same morning advising organizations that use PHP to be ready for an update fixing two critical vulnerabilities (NSA post).

Staying on Drupal? Do this

1. Ask your host or developer which PHP and Drupal versions you run, and whether both still get security fixes.
2. Update PHP to a supported version that your Drupal version supports.
3. Update Drupal core and contributed modules. Drupal's status report flags a PHP version that's "too old."
4. On Drupal 7? Plan a migration or buy extended support (drupal.org).
5. Back up your site somewhere off your server, before and after.
6. Watch for warning signs like admin accounts or pages you don't recognize. Call your host first.

How moving to WebZum works

Paste your current website and get a fresh new one in minutes, built from your info and photos. WebZum reads up to 5 pages of your Drupal site, uses them for your business details, reuses up to 12 of your photos, and writes all-new pages. It doesn't carry over your logo, your old wording, your blog posts, your page addresses or redirects, or your search rankings. Some sites can't be read. If yours can't, describe your business instead. Your old site stays up until you point your domain to the new one.