Alternatives to WordPress inspired by PHP vulnerabilities

The problem this time is in PHP, which is the foundation of WordPress.

WordPress is software for posting and managing articles. One of the mechanisms that supports this operation is PHP, which runs on the server.

In October 2026, the following serious vulnerabilities in PHP were announced. A vulnerability is a weakness in software that can be exploited in an attack.

• CVE-2026-109618:When processing is interrupted due to insufficient memory, post-processing handles incomplete internal data.
• CVE-2026-109619: An issue where internal information pointing to memory that has been used remains, and subsequent requests refer to the old information.

Conditions may allow external parties to execute arbitrary code on your server. This is a separate problem from WordPress itself, so in addition to updating WordPress and plugins, you also need to check for fixes on the PHP side.

The versions in which the fix was first provided are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Please check the instructions from your hosting company or OS provider for actual support. In addition to the version number, you need to check whether the provider has applied any fixes.

Reference: IPA: Current PHP vulnerabilities and countermeasures / PHP official: OOM processing problem ／ PHP official: Problem with old internal state remaining

Before looking for an alternative, organize your article writing style and required features

What I would like to start my comparison with is how I usually update. Do you want to write from your smartphone or can you edit the file on your computer? Do you need comments, membership registration, and sales functions? Your options will change accordingly.

Option 1: Continue with WordPress and review maintenance

If you find the current editing screen and features comfortable to use, you have the option to continue. Plugins are components that add functionality. Decide who will be in charge of updating the main unit, plugins, theme, and PHP, and the procedure for restoring from backup.

When entrusting maintenance to a maintenance company or managed service, check the scope of the work, including whether they will be able to deal with plug-in issues and recovery.

Reference: WordPress official safety guide

Option 2: Use a managed CMS or site creation service

CMS is a system that allows you to create and manage articles from a browser. If it is a managed service, you may be able to leave the maintenance of servers etc. to the operator. The scope of responsibility varies depending on the service.

In addition to the editing screen, ease of use in Japanese, necessary functions, and pricing, we will check whether you can export articles and images and move to another service. We will not rank specific services in terms of safety here.

Option 3: Make it a static site

A static site is a method of distributing pre-made pages. Sites that mainly publish text and images are candidates. On the other hand, the posting screen must be prepared separately.

There are ways to directly edit page files called HTML, use tools that generate pages from manuscripts, and combine them with a CMS for editing. The more you compensate for the ease of updating, the more mechanisms you have to maintain.

Reduce attacks in advance with Cloudflare's WAF

Cloudflare has a WAF that inspects suspicious communications before the site. It plays a role similar to security at a reception desk, and can block communications that resemble known attacks, and restrict access by source or number of times it is sent.

Free has rules for some threats, and Pro and above have a wider range of managed rules. Managed rules are judgment rules prepared and updated by Cloudflare. DDoS countermeasures are countermeasures against attacks that make a site unusable due to a large amount of traffic.

Protection rules for this PHP vulnerability have also been made public. However, there are application conditions depending on the settings, and it is a countermeasure against known attacks. It is not possible to conclude that if you use Cloudflare, you do not need to update PHP.

Reference: WAF feature comparison / WAF countermeasures and conditions for this PHP vulnerability

If the original server is located separately, measures are also required to prevent bypassing the WAF by directly accessing that server. Even for static sites, take into consideration issues such as hijacking of public accounts, problems with external services, and unsolicited form submissions.

Just make an inquiry and let Cloudflare handle it.

This does not mean that you cannot make inquiries on a static site. The page remains static, and you can add processing only to the part that accepts inquiries.

Workers is a service that runs small programs such as form reception on Cloudflare. Turnstile is a mechanism to reduce sending by bots, and Email Service is responsible for sending notification emails.

Sending an email is free if you just want to notify a verified administrator address. To automatically reply to inquirers, use Email Sending and Workers Paid, which can be sent to any recipient. Email Sending is in beta at the time of information confirmation.

Email Routing is a service that forwards emails addressed to your own domain to your existing inbox. It does not provide an inbox per se for reading emails. Also, notifying the administrator from a form and forwarding emails to your own domain are separate functions.

In order to avoid losing inquiries, we also design guidance in the event of a transmission failure, handling of retransmissions, and confirmation of receipt. It is also important not to ask for too much confidential information in a form, and decide where to save it, who can view it, and how long it will be kept. If you have an existing email service, make sure that you do not accidentally change the DNS settings that determine recipients.

Turnstile requires JavaScript in your browser. We will provide you with alternative contact methods so that you can contact us even if the request is invalid or the transmission fails. The site text and table of contents can be separated from the form and configured to be readable in regular HTML.

Reference: How to validate Turnstile / Email Service overview / Configure email forwarding

How much does it cost for general use/corporate use?

The following is a configuration example assuming a static site with one domain and a small inquiry form. Does not include additional services such as CMS posting screen, membership/payment functions, attachment storage, monitoring/resending. If you want to keep WordPress, you will need to pay for the server separately.

Amounts are in US dollars as of October 25, 2026. Taxes, exchange rates, acquisition and renewal of unique domains, inboxes, and labor costs for production and maintenance are not included. Think of it as ``minimum monthly fee + amount beyond the included usage''.

General use: If you only want to notify the administrator, start with the free tier.

For personal blogs, hobby sites, etc., it would be nice to be able to see inquiries in your own inbox. There will be no automatic reply, and the transmission result will be displayed on the screen.

Whether the free tier is sufficient depends not only on the number of accesses, but also on processing time and implementation. Even if the notification email to the administrator is free, there are other restrictions on the execution of the reception program.

Corporate use: Add auto-reply and paid WAF

This is an example of returning a reception email to the inquirer and using broader WAF rules. This does not mean that you necessarily need this plan just because you are a company. Choose according to the role of the site and the impact of outage.

Workers Paid includes a monthly email sending allowance of 3,000 emails with a base price of $5/month minimum. Overage is $0.35 per 1,000 emails. Sends to confirmed administrators are not included in this frame. As resending and other purposes also use the sending quota, there is no guarantee that we will be able to receive 3,000 inquiries.

Comparison including annual payment and Business

Annual payments for Pro are $240/year, and annual payments for Business are $2,400/year. A minimum of $5/month for Workers and excess usage will be charged separately. This is not a contract where you pay the monthly equivalent amount shown in the table every month.

Business has an SLA (contractual agreement regarding uptime) for website plans, but this does not guarantee the entire system, including form processing and email delivery. If continuous operation is important, evaluate failure detection, failure recovery, and handling of beta features.

Requests for static files are free and unlimited, but there are restrictions on the number of files, capacity, etc. WAF is assumed to be set to an applicable route such as the target's own domain, and care must be taken when accessing from another public URL.

• Website plan pricing
• Workers pricing
• Email sending/forwarding fees
• Turnstile pricing
• Static delivery charges and limits
• Pages static delivery/Functions pricing
• Workers Usage Limits
• Pages Usage Limits

Before migrating, check whether there will be any problems before considering the price.

If updating every time becomes a burden after migration, it will be difficult to continue using the site. We think it's a good idea to first try posting and publishing a small number of articles.

• Update:Can the person in charge write the article, add images, and publish it?
• Existing page:Can the previous URL be maintained? If I want to change it, can I be guided/redirected from the old URL?
• Attached functions:How to carry over comments, search, categories, RSS, forms, etc.
• Recovery:If you publish incorrect content, can you return to the previous state?
• Export: Can articles and images be backed up and moved elsewhere in the future?
• Management:Can the account be managed by multiple people? Can I set up multi-factor authentication?

There is also a way to continue using WordPress and set up a maintenance system. You can leave this to a managed service, or you can make the publishing side static. I would like to select the configuration that suits my site by checking the necessary functions and the scope of continued updates and maintenance.