Move to MotokoGet the PHP migration skill
Security brief

Runtimes · web servers · AI tooling

Read the brief

AI-assisted migration to Motoko + ICP

Move beyond the
patch cycle.

Rebuild your PHP application in Motoko on the Internet Computer. Your coding agent maps the site, proposes the plan and carries out the approved migration.

Start with your PHP app

Read-only inventory first. Your approval before changes.

Why Motoko and ICP?
THE FIRST MIGRATION PATHPHP → MOTOKO
A PHP application is rebuilt by a coding agent as Motoko logic and persistent data on the Internet Computer.
Motoko for the application.
The Internet Computer for the platform.
Your PHP
application
Motoko on ICPApplication + persistent data
01

Preserve the experienceContent, URLs and critical journeys.

02

Replace the runtimePHP logic rebuilt in Motoko.

03

Control the transitionScope, data and cutover approved by you.

First migration path: PHP to Motoko.

WordPress, Drupal, Joomla, Magento and custom PHP. Framework applications too: Laravel, Symfony and CodeIgniter.

What changes with Motoko + ICP

Less infrastructure
to patch.

Retire the layers your application no longer needs. Keep a clear plan for the parts you still own.

Architecture changes when a conventional web application is rebuilt in Motoko with its frontend and backend on the Internet Computer
LayerA conventional web stackAfter a full-IC rebuildFrontend and Motoko backend on ICP
RuntimePHP or Node.js and the modules that process server requests.Motoko compiled to WebAssembly.The replaced runtime leaves the migrated application’s execution path.
HostingAn application server, operating system and web-server configuration.Canister execution on the Internet Computer.A full-IC deployment can retire the application’s VM or hosting plan.
DataA separate database, connection layer and database credentials.Persistent state, replicated across a subnet.Replace the separate database where the approved data model fits.
DeliveryPages and assets delivered by your hosting provider.Certified frontend responses.A verifying gateway checks responses against canister state.

A clearer application
to own.

Your team still manages application security, permissions, controller keys, upgrades, recovery and cycles funding. Dependencies and integrations still need review.

Keep the frontend on your current host? Its delivery and integrity continue to depend on that host. The migration skill available here currently covers PHP applications.

Use the migration skill

Start in your
coding agent.

The skill guides your agent through discovery, rebuilding and verification, with approval before changes.

  1. Open the existing PHP project

    Use a coding agent with access to your repository.

  2. Choose where the frontend lives

    Host it on ICP or keep it with your current provider.

  3. Copy the brief into your agent

    Review its inventory and proposed plan before approving changes.

Have the PHP source ready. During inventory, the agent identifies the data, files and access the migration needs.

Explore the five reference guides
Understand the existing siteRead-only inventory guidance and feature mapping.
Account for your PHP frameworkCMS and framework-specific migration decisions.
Move data deliberatelyExport guidance, conversion examples and reconciliation.
Build on a Motoko exampleContent storage, imports and access checks to adapt.
Preserve the routes people useLegacy links, redirects and cutover verification.

Your coding agent carries out the migration in your project.

migration-brief.txtRead the skill ↗

Your migration brief.

Choose the target, then copy the brief into your agent.

Where should the frontend live?

Frontend and Motoko backend on the IC.

Download skill ZIP ↓Download brief (.txt) ↗

Prefer local skill files? Attach the ZIP.

The migration, step by step

A migration your
team can sign off.

Six stages, with checks before the next step.

  1. 01

    Inventory the whole site

    Map every page, feature, dataset, account flow and integration.

    Read-only inventory
  2. 02

    Approve the migration plan

    Review the scope, architecture, costs, data move and recovery plan. The agent waits here.

    Your approval
  3. 03

    Rebuild the application

    Implement the frontend and Motoko backend, with real workflows and permissions.

    Working application
  4. 04

    Move and reconcile the data

    Rehearse imports. Check records, files and relationships.

    Verified data
  5. 05

    Reconnect existing users

    Link legacy accounts to Internet Identity with verified proof. Test roles, sign-in and recovery.

    Verified account access
  6. 06

    Cut over and verify live

    Complete the approved cutover and test the real site, including recovery.

    Live site + handover

More than the homepage

Plan for the
whole application.

Every feature, dataset and integration belongs in the plan—and needs a check that it works.

This table shows the full-IC target. With hybrid hosting, the rebuilt frontend and its domain stay with your host.

Explore all seven migration componentsPages · logic · data · files · accounts · jobs · domain
YOUR EXISTING SITE → THE INTERNET COMPUTER

Showing all 7 migration components

What each part of a PHP website becomes in a whole-site migration
What you haveWhat it becomesWhat your agent verifies
01 Pages & templatesA built frontend served as certified assets.Content, URLs, SEO, redirects, accessibility, and search.
02 PHP code & pluginsMotoko canisters with explicit application interfaces.Business rules, forms, permissions, integrations, and plugin replacements.
03 DatabasePersistent application state with a deliberate data model.Imported IDs, relations, constraints, totals, and recovery.
04 Uploads & documentsCertified assets or a file-storage design sized for the site.File hashes, links, access rules, capacity, and running costs.
05 Logins & user accountsInternet Identity with verified legacy-account linking.Existing users, ownership, roles, recovery, and the transition plan.
06 Scheduled jobsCanister timers and durable coordination where appropriate.Retries, duplicate handling, external services, and behavior after upgrades.
07 Your domain nameThe same custom domain pointing at the new IC site.Authorized DNS changes, TLS, paths, redirects, and identity origins.

Your domain can stay yours. Custom-domain setup requires DNS authority and an HTTP-serving canister that meets the registration requirements. How custom domains work ↗

For the sites people depend on

Government websites.
Company applications.

Public services and customer applications need different plans. Start with the people, workflows and data your site supports.

01 / PUBLIC SECTOR & INSTITUTIONS

Public sites
and services.

Preserve accessible pages, documents and stable links. Plan publishing roles, service forms and data handling around your institution’s requirements.

Public informationDocuments & archivesEditorial workflows
Plan an institutional site
02 / COMPANIES & PRODUCT TEAMS

Customer sites
and applications.

Rebuild business rules, account access and integrations while preserving the agreed customer journeys.

Content & commerceCustomer accountsAPIs & scheduled jobs
Plan a company site

Agree data location, confidentiality and operating ownership in the migration plan.

Review data handling

For your developers

A closer look
at the code.

A small example shows how a PHP session and database write become a caller-identified Motoko method.

See PHP and Motoko side by sideA signed-in note, saved with persistent state.
save.php
<?php
session_start();
if (!isset($_SESSION['user_id'])) {
    http_response_code(401);
    exit;
}

// Assumes a configured PDO connection.
$stmt = $pdo->prepare(
    'REPLACE INTO notes (user_id, body) VALUES (?, ?)'
);
$stmt->execute([
    $_SESSION['user_id'], $_POST['body']
]);
Application code + PHP runtime + database
MOTOKO main.mo
import Map "mo:core/Map";
import Principal "mo:core/Principal";

persistent actor Notes {
  let notes = Map.empty<Principal, Text>();

  public shared ({ caller }) func save(body : Text) : async Bool {
    if (caller.isAnonymous()) return false;
    notes.add(caller, body);
    true
  };
};
Persistent application state in a canister

Illustrative signed-in note example. The PHP route assumes a configured database and protected POST handling. Production code needs suitable input limits, permissions and account recovery. Motoko example type-checked with moc 1.14.0 and core 2.6.2.

Current Motoko actor syntax ↗

Security brief / 13–21 October 2026

Security disclosures.
Across the stack.

Runtime flaws, compromised releases and certificate trust have different remedies. Review the layers your application relies on—and patch what you run today.

PHP

Application runtime

Two critical runtime flaws

The 21 October release fixes two critical request-memory flaws that can permit remote code execution. Apply the PHP security update.

PHP release

Node.js

Application runtime

Security fixes across supported releases

Node.js issued security updates for its 22.x, 24.x and 26.x lines, including a high-severity Brotli decoder out-of-bounds write that permits remote code execution.

Node.js advisory

Next.js / React

Application framework

Critical flaws in server-side features

Next.js released fixes for two critical remote-code-execution vulnerabilities and a high-severity denial-of-service issue affecting particular server-side features and dependencies.

Next.js advisory

NGINX

Web server and proxy

Five configuration-dependent security fixes

NGINX patched buffer overflows, HTTP/3 request-body injection, TLS session forgery and an AIO use-after-free. Exposure depends on the features and configuration in use.

NGINX release

LiteLLM

AI software supply chain

Compromised release artifacts

LiteLLM reports its release pipeline published malicious 1.107.0 PyPI wheels and container images. Affected releases were withdrawn or repointed to verified clean artifacts.

Incident report

eMudhra

Certificate trust / WebPKI

Eight intermediate certificate keys compromised

Cloudflare reports that private keys for eight eMudhra intermediate certificates were compromised. Its response includes trust-store updates and software fixes across affected services.

Cloudflare report
More disclosures across the stackGitLab, Oracle, .NET Framework, Traefik and MCP

GitLab

Development infrastructure

Critical server code execution / CVSS 10.0

GitLab patched CVE-2026-110264, rated CVSS 10.0: under certain conditions, unauthenticated attackers could execute code on the server through a crafted regular expression. Upgrade affected self-managed installations immediately. GitLab.com is already patched.

Advisory

Oracle / Java / MySQL

Enterprise software and data

A broad enterprise patch release

Oracle's quarterly update covers vulnerabilities across product families, including Java and MySQL. Its risk matrices identify affected versions and which issues can be reached remotely without authentication.

Advisory

.NET Framework

Application runtime

Runtime security updates

Microsoft's October cumulative update fixes multiple remote-code-execution, denial-of-service, privilege-escalation and spoofing vulnerabilities in .NET Framework.

Advisory

Traefik

Proxy authentication

Identity could cross client connections

Traefik's ForwardAuth middleware could reuse an authenticated connection for another client when the authentication server uses NTLM or Negotiate, allowing access under another user's identity.

Advisory

MCP TypeScript SDK

Agent server isolation

Shared HTTP instances could leak messages

Affected MCP HTTP servers could deliver one client's responses or notifications to another when clients shared a server or stateless transport instance. The fix requires isolation as well as an upgrade.

Advisory

These are vendor-confirmed advisories, not evidence that every affected deployment was breached. The available migration skill targets PHP; the broader list provides security context. Sources and scope notes ↗

The runtime flaws and the supply-chain incidents are separate problems. Replacing a runtime removes that execution path; build integrity, credentials and HTTPS still need protection. Retained source control and CI/CD services still need updates.

See what changes on ICP

Patch first. Migrate with a plan.

Still running PHP?
Patch it today.

Keep the existing site patched throughout the migration. A CMS update alone does not replace the PHP runtime fix.

REPORTED PRECAUTIONARY OUTAGES

When public information
has to go offline.

NOS reported government, education, and company websites going offline as a precaution while operators prepared PHP updates. The reported public websites included:

MijnOverheidGovernment portal
DigiDPublic website
Tweede KamerDutch House of Representatives

These are reported outages, not claims of a breach or migration to ICP. DigiD authentication remained available for other services.

Read the NOS reporting ↗
NCSC Netherlands government emblem

The Dutch NCSC published its own statement. It said it temporarily took NCSC.NL offline as a precaution. Read the government statement ↗

UPDATE THE PHP RUNTIME

A CMS update alone doesn’t
replace this fix.

Running WordPress, Drupal, Joomla, Magento, or custom PHP? Check the PHP runtime as well as your application. Follow your hosting provider’s security instructions.

WordPressDrupalJoomlaMagento Open Source
21 OCT SECURITY RELEASE8.5.12

Your distribution may provide a backported fix with a different version number. Confirm the advisory with your provider.

Official PHP release advisory ↗

The flaws are in PHP itself. Wiz researchers report working attacks against WordPress, Drupal, and Joomla container deployments. A complete rebuild removes the PHP engine and those execution paths. Any PHP you keep still needs patching.

Research ↗

42 FIRST-PARTY PUBLICATIONS

The PHP2Shell response.
Read it at the source.

Original research, maintainer releases, provider updates and public-agency warnings. Every logo opens the original publication.

Companies & projects28

The maintainers, researchers and providers responding to PHP2Shell.

Public agencies14

Official security notices from national and public-sector organizations.

Publications dated 20–21 October 2026; some describe the situation before patches were released. Logos identify the cited sources; no endorsement or affiliation is implied. Source data · Logo credits

The practical questions

Before you move.

What stays, what changes, and what needs a deliberate plan.

Does this move an entire CMS or application?

Yes—the skill covers the whole application. Your agent inventories and rebuilds its behavior, data and integrations. Plugins, editorial workflows and permissions need deliberate replacements and verification.

Can this migrate a Node.js application too?

The downloadable skill currently targets PHP. A Node.js rebuild needs a separate assessment of server routes, npm dependencies, data, accounts and integrations. Your developer or coding agent can start with the official ICP skills ↗. A dedicated Node.js migration workflow is not included here.

Do these PHP exploits happen on Motoko?

The disclosed PHP engine flaws need the vulnerable PHP runtime. A complete replacement with Motoko removes that runtime from the migrated application. This doesn’t mean every exploit disappears: application bugs, stolen credentials, bad permissions, unsafe integrations, and insecure upgrades remain possible.

Can we keep our domain, content, and design?

Yes, subject to your approved migration plan. The inventory accounts for existing content, files, routes, redirects, design, search, and accessibility. A custom domain can point to the new IC site after authorized DNS and registration work. Account migration and external services need their own explicit transition plans.

Can we keep our URLs and SEO setup?

Preserving established public URLs is the default. If a URL must change, the plan includes a redirect or a legacy-URL mapping appropriate to the hosting target. The agent verifies direct page loads, crawlable content, page titles, canonical tags, robots rules and the XML sitemap on the final domain. Search rankings cannot be guaranteed.

Will the agent change things immediately?

No. Start with a read-only inventory and a migration plan for your approval. After sign-off, the agent works through reversible steps. It asks again before freezing writes on the old site, changing DNS or decommissioning it.

Can Motoko run on our existing PHP host?

A normal PHP hosting plan is not a drop-in production runtime for Motoko canisters. The supported deployment described here runs the Motoko backend on the Internet Computer. You can keep a compatible static frontend on your current host and connect it to that backend, but frontend integrity still depends on that host.

What does our team still operate?

The IC network provides execution and replication. Your team still owns application changes, access permissions, controller keys, cycles funding, integration health and recovery procedures. The migration handover should explain these responsibilities and the expected running costs.

Is this suitable for private or regulated data?

Assess the actual workload before choosing the architecture. Standard canister memory is not confidential from node operators. Data location, access, retention and encryption requirements belong in the plan; deploying on ICP does not by itself establish regulatory compliance. Read the platform security guidance ↗

Start with the inventory

Start with your
PHP project.

Open your codebase, copy the brief and review the migration plan.

Get the PHP migration skill