You patched PHP on every server this week. BookPress sites run without it.
✓ Thanks, we'll be in touch.
We answer within one working day. Meanwhile there's a live one to try: spin up a demo site →
BookPress serves WordPress sites, plugins and admin included, from one compiled engine with no PHP interpreter in the request path. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lives in that interpreter. Move ten non-critical sites onto BookPress for twelve months at no charge, and move them back with one command whenever you want.
What PHP2Shell is
On 21 October 2026 the PHP project fixed two bugs rated 9.2 of 10: CVE-2026-109618, where a request that runs out of memory half way through setup leaves data the cleanup then trusts, and CVE-2026-109619, where state left behind by one request reaches the next request on the same worker. The fixes are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; PHP 7.4 to 8.1 got source patches only, and anything older got nothing. The PHP project says every installation that serves web requests is in scope: PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed. Attack attempts were seen four days before the fix was public.
Why a BookPress site sits outside it
BookPress serves a site from its own engine, and that engine contains no code from the PHP project: nothing is copied, compiled or linked from PHP, so the two PHP2Shell bugs have no code to live in. There is no PHP-FPM, mod_php or other PHP process in the request path; your plugins, your theme and your wp-config.php run inside the BookPress engine. The engine keeps no PHP sessions and has no upload-progress handler, the paths the second bug reaches. Each worker wipes its request state at the end of every request, and a request that reaches its memory cap is stopped and its memory discarded. The WordPress install you import from keeps serving on its own PHP until you switch, so update that PHP today in any case.
One command in, one command back
Import dumps the live MySQL database through the site's own WP-CLI, copies wp-content, and records how to reverse itself:
wp bookpress import --dir=/var/www/wordpress --dry-run
wp bookpress import --dir=/var/www/wordpressExport writes the source's own schema back, database and uploads, and refuses to overwrite a live site without asking:
wp bookpress export --dir=/var/www/wordpressYour themes, plugins, users and URLs stay as they are. The pilot install page walks through the first site step by step.
What the pilot is
Ten non-critical sites, twelve months, no invoice. You keep WordPress in place and tell us what changed.
Not a host or agency? Managed WordPress hosting on BookPress is coming. Join the list →