Loving Tina? us on GitHub0.0k

The WordPress engine has cracked

By The TinaCMS Team

If you use WordPress for your websites you've likely had a headache of a week. Meanwhile TinaCMS users have been sleeping like babies.

WordPress runs on PHP, on October 21, 2026, the PHP project released emergency fixes for 2 critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell.

  • Both flaws can let an attacker run code on your server without logging in
  • The flaws are in PHP, not WordPress or a plugin, so a WordPress update doesn't fix them
  • Update PHP, or ask your host to

PHP fix: Patch now

There are 2 ways to patch your site, depending on who manages your PHP installation:

  • A managed host runs it. Ask your host to confirm they applied both fixes and restarted PHP.
  • You run the server. Update PHP to the fixed release for your version, then restart the services that use it:
    • 8.5.12
    • 8.4.27
    • 8.3.36
    • 8.2.35
    • PHP 8.1 and older get no fix from the PHP project, so get vendor guidance

To see a site's PHP version, open Tools > Site Health > Info > Server in WordPress.

Risk is highest on Apache with mod_php. Researchers showed an attack there that runs before any application code, so a WordPress login can't protect you. Exposure is a reason to patch, not proof of a break-in. See the PHP security advisory for details.

Why do customers still choose WordPress?

Teams choose WordPress for good reasons: clients are familiar with its editor, and developers know how to build and deliver sites with it. It's also basically everywhere: W3Techs measured it at 39% of all websites on October 23, 2026. But you also maintain everything under the pages.

Two icebergs. The WordPress iceberg shows pages above the water and a large mass below it: PHP runtime, WordPress core, plugins and theme, hosting and patches, backups and old integrations. An arrow points to a smaller TinaCMS iceberg: pages above the water, and only content files in Git, frontend and build, static hosting, and TinaCloud or your own backend below it. The Tina llama stands on the TinaCMS tip.

Figure: Move from WordPress to TinaCMS. Faster site and smaller attack surface

Sizing up the move

Removing PHP means replacing WordPress. That can involve untangling themes, page-builder layouts, custom fields and publishing workflows.

To size that cost, ask:

  • How much content is useful outside the current theme and plugins?
  • Can another developer rebuild the site from documented access, or does it depend on one person's memory?
  • What Claude subscription do you have? 😜

Better solution… TinaCMS

TinaCMS stores content as Markdown, MDX and JSON files in your GitHub repository. Editors get a CMS interface, and each save is a commit. TinaCloud runs the editor backend, or you can self-host it.

You build the frontend with Astro, Next.js or another React framework.

Try it with a pilot

  1. Start a TinaCMS project: npx create-tina-app@latest
  2. Pick 2 or 3 representative pages, including an awkward layout
  3. Move content and media with our WordPress to TinaCMS guide. Design and plugin behavior need separate work.
  4. Keep existing URLs, or map redirects
  5. Have a real editor do their normal tasks on a preview deployment

Speed it up with AI ✨

An AI coding assistant can scaffold the pilot from a screenshot. Our vibe blogging walkthrough shows how.

WordPress is legacy software, built for the web 23 years ago and older than some of our TInaCMS developers! The PHP2Shell exploit is a good reason to reopen this conversation, and build a quick prototype to nail the discussion.

For help with the move, join the TinaCMS community on Discord.

Last Edited:
Last Page
Spit Happens: September 2026 News - Pickier media, lighter editor