Your PHP server may let anyone run their own code.
We fix it today.
Two critical bugs in PHP itself — not in WordPress, not in your plugins — allow an attacker to take full control of a server without any password. Most small and legacy websites are affected and nobody told their owner. We check, patch and verify your server. A real engineer does the work, and you get a written report.
No account needed · 24-hour response · You approve before we touch production
$ php -v
PHP 7.4.33 (cli) (built: Nov 3 2022)
> CVE-2026-109618 / 109619: VULNERABLE
$ check the fix for this version
7.4 reached end of life — no official patch exists
> ACTION NEEDED: migration to 8.3 required
# after our work
$ php -v
PHP 8.3.36 — patched · verified · tested
How it works
Four steps. No surprises.
We never start on your live server. First we prove the fix works on a copy.
You send the details
Website address, PHP version if you know it, and your hoster. If you do not know the version, that is fine — that is what we are here for.
We inspect and confirm
We check your actual PHP version, your extensions, and whether your site already shows signs of compromise. You get a short verdict before any work starts.
We patch on a copy first
We apply the update on a duplicate of your site and test it. You approve the result. Only then do we touch the live server.
You get proof
A written report: old version, new version, test result, and the exact commands we ran. Something you can show your client or your boss.
Am I affected?
Find your PHP version
Every PHP version from 5.4 to 8.5.11 is affected by at least one of the two bugs. Compare your version with this table.
| Your PHP version | Status | Safe version |
|---|---|---|
| PHP 8.5.12+ | Safe | 8.5.12 |
| PHP 8.5.0 – 8.5.11 | Not safe | 8.5.12 |
| PHP 8.4.27+ | Safe | 8.4.27 |
| PHP 8.4.0 – 8.4.26 | Not safe | 8.4.27 |
| PHP 8.3.36+ | Safe | 8.3.36 |
| PHP 8.3.0 – 8.3.35 | Not safe | 8.3.36 |
| PHP 8.2.35+ | Safe | 8.2.35 |
| PHP 8.2.0 – 8.2.34 | Not safe | 8.2.35 |
| PHP 8.1 and older | No official fix | — |
| PHP 5.4 – 7.4 | No official fix | — |
How to find your version: in WordPress go to Tools → Site Health → Info. In cPanel or Plesk look for “Select PHP Version”. On a server, run php -v. If none of this makes sense to you, send us the website address and we will check it for you.
Fixed prices
Clear price. No hourly guessing.
One server, one price. If we cannot fix it, you do not pay.
Check
- Full inspection of PHP version and extensions
- Compromise check on logs and files
- Written verdict with what to do next
- Credited to a Fix if you continue
Fix
- Everything in Check
- Patch tested on a copy of your site
- Live patch with your approval
- Before/after verification report
Fix + Clean
- Everything in Fix
- Malware and backdoor removal
- Hardening and safe configuration
- 30 days of follow-up monitoring
More than 3 servers, agency pricing, or an older PHP that must be migrated? Tell us in the form and we send a fixed quote within one working day.
Who we are
A small team that runs production servers every day.
We are not a call centre. The person who patches your server is the person who runs validator infrastructure for a living — where a single mistake costs real money.
✓We do
- Work on a copy before touching production
- Tell you the exact version numbers
- Ask for your approval at every step
✕We do not
- Read your customer data or your database
- Change your site design or content
- Take a payment before you see a verdict
→What you need to give us
- Access or a person who can run commands
- A current backup of the site and database
- A short window where changes are acceptable
!If we cannot fix it
- You do not pay for the Fix
- You still keep the full report
- We tell you clearly if migration is the only honest answer
Request
Tell us about your server
Six fields. Two minutes. No account, no card.
- Reply within 24 hours, in your language
- Fixed price before any work starts
- No subscription required
Questions