A static rebuild converts a WordPress or PHP brochure website into plain HTML files. With no PHP running on the server, the site is not affected by CVE-2026-109618, CVE-2026-109619 or any future PHP vulnerability, loads faster and is cheap to host. It suits showroom and brochure sites without a shop, bookings or member logins. LegacyPatch rebuilds them from $490.
Are showroom and brochure websites affected?
Yes, if the site runs on PHP, which includes every WordPress site. The flaw is in PHP itself, in how the server handles incoming requests, not in your data. On Apache mod_php, the demonstrated attack works with a single request before your website's own code even runs. No customer database doesn't mean no risk. An attacker who takes the server can:
- Deface the site or inject malware that infects your visitors
- Add hidden spam pages that wreck your Google ranking
- Host phishing pages on your domain
- Get the site flagged by Google as harmful, or suspended by your host
For a dentist, a car dealer or a law firm, that red browser warning in front of your site is the business damage.
Patch, upgrade or go static?
| Patch / upgrade PHP | Static rebuild | |
|---|---|---|
| Fixes CVE-2026-109618 & 109619 | Yes | Yes |
| Protected from future PHP flaws | Only if kept updated | Yes, no PHP |
| Plugins and core to keep updating | Yes, ongoing | None |
| Speed | Depends on hosting and plugins | Very fast |
| Hosting cost | PHP hosting | Free-tier static hosting often enough |
| Editing in wp-admin | Yes | No, edits via us or a simple editor |
| Shop, bookings, logins | Supported | Not a fit |
Is my site a good fit for a static rebuild?
Great fit: showrooms, dealerships, clinics, dentists, law firms, real-estate offices, restaurants, trades, nonprofits and portfolios. Basically any site that's pages, photos, a map and a contact form.
Not a fit: online stores, booking systems, member areas or sites your staff edit daily. For those, upgrade PHP instead.
Will I lose my Google rankings?
Not if it's done right, and keeping them is part of the job. We keep your existing page URLs, titles, meta descriptions, headings and images, add 301 redirects for anything that has to move, and publish a fresh sitemap. Static sites are fast, and page speed is something Google measures.
How the static rebuild works
- Free check and quote based on your page count and forms.
- Capture every page, image, document and URL of your current site, with your written permission.
- Rebuild as clean static HTML with the same design and content. Licensed premium theme assets stay under your license.
- Forms are moved to a form service such as Formspree, delivered to your inbox.
- Launch on a static host or CDN, DNS switched, redirects and sitemap verified.
- Old PHP site retired, removing the vulnerable server from the equation.
Frequently asked questions
Can you convert my WordPress site to static HTML?
Yes, if it's a brochure or showroom site without a shop, bookings or logins. We rebuild it as static HTML with the same design, content and URLs, from $490.
Is a static HTML website affected by CVE-2026-109618?
No. A site served as plain HTML with no PHP on the server isn't affected by these or any future PHP vulnerabilities.
Will my contact form still work?
Yes. Forms are moved to a form service such as Formspree and arrive in your inbox, with spam protection.
How do I update my static site later?
Send us the change. Small edits can be covered by an ongoing care plan, and larger updates are quoted up front. For frequent self-editing we can recommend a simple editor setup.
Is hosting a static site expensive?
Usually the opposite. Static hosts and CDNs such as Netlify, Cloudflare Pages and GitHub Pages offer free tiers that comfortably serve most small business sites.
Can you rebuild my premium theme?
We rebuild your own website's pages for you. Licensed third-party assets stay under your license, and we never resell or redistribute someone else's theme.
Make your site permanently PHP-proof
Static rebuild from $490. Same look, same URLs, nothing to patch ever again.
Related services
Last updated October 22, 2026. LegacyPatch is an independent service provider and is not affiliated with The PHP Group. Prices in USD; GBP and EUR invoices on request.