Goodbye WordPress: Migrating chrishayward.co.uk to Hugo in under 2 hours with Claude Code
This week two critical remote code execution vulnerabilities in PHP itself were disclosed: CVE-2026-109618 and CVE-2026-109619, nicknamed “PHP2Shell”. These aren’t bugs in a plugin or a theme, they’re in the PHP core engine, so anything running on PHP (WordPress, Drupal, Joomla and the rest) was potentially exposed. Details leaked before the coordinated release, PHP pushed out emergency patches on 21 October, and there were already reports of active exploitation attempts. Yes, I patched. But it made me ask a question I’d been avoiding for a long time: Why am I still running a PHP server at home for a blog that is essentially an archive? ...