Secure your PHP application. Keep your business moving.
We help you patch urgent PHP vulnerabilities, investigate suspected compromises, modernize existing applications, or migrate to a different stack—with a clear plan for your features, data and integrations.
Read-only scan · no signup · results in ~15 seconds
Fixed releases
8.2.35 · 8.3.36 · 8.4.27 · 8.5.12
Why act now?
If your PHP application is affected by a known vulnerability, delaying a fix leaves that weakness available to attackers. A compromise can expose customer data, interrupt sales and operations, and make recovery more costly.
Start by confirming your PHP version and your hosting provider’s patch status. If you’re affected, prioritize remediation. If you’ve noticed suspicious activity, investigate that too—installing a patch doesn’t remove an attacker who already has access.
Secure
Patch and verify your current application
Investigate
Understand signs of compromise
Modernize
Upgrade with a tested rollout plan
Migrate
Move to a different technology stack
What happened
The two flaws, in plain language
CVE-2026-109618
Half-finished requests leave memory open
When a request runs out of memory, PHP aborts it mid-flight. In some situations — like a large file upload — the abort happens while internal bookkeeping is only half-written. The cleanup routine then treats that uninitialized memory as valid data, and an attacker can shape what's left behind.
CVE-2026-109619
Yesterday's request haunts the next one
A PHP worker keeps some state between requests. When a fatal error interrupts cleanup, that state can keep pointing at memory that has already been freed — and the next request served by the same worker reads it before it is reset.
Oct 20, 2026
The PHP project announces an emergency security release, 24 hours ahead.
Oct 21, 2026
Fixes ship in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Check your vendor for patched packages.
Now
Confirm your deployed runtime and vendor patch status, then plan remediation.
Start with version evidence
Is your site exposed?
Enter your address and we'll run a gentle, read-only scan of your public pages. Can't detect it automatically? We'll walk you through a 30-second manual check — or one of our engineers will do it with you.
Run the free checkHow we fix it
A calm, proven playbook
Inventory
We find every PHP runtime you run — production, staging, cron jobs, containers, the forgotten subdomain.
Patch or upgrade
We move you to a fixed release, upgrading safely where your host or OS lags behind.
Shield in the meantime
We assess temporary exposure-reduction measures while arranging the patch. Filtering does not replace updating PHP.
Verify & document
We confirm the fix on every host, test your app still works, and hand you a clean report for auditors.
Why FixYourPHP
Meet Thomas Mercer
Technology leader & software architect
Thomas Mercer is a hands-on technology leader and software architect with more than 25 years of experience building and supporting ecommerce platforms and business-critical systems. His career includes work at Verizon, True Corp, Mastercard, Central Retail Group, and aCommerce Asia.
He specializes in PHP, Laravel, CodeIgniter, API integrations, and backend architecture, with extensive experience connecting Shopify Plus, ERP systems, payment services, and inventory platforms.
His expertise also spans security hardening, AWS infrastructure, Linux and Nginx administration, database optimization, and automation. Thomas combines strategic leadership with practical development to build secure, reliable systems that simplify operations and support business growth.
- Engineers, not scripts — every fix is verified by a person who reads code.
- Legacy friendly — assess compatibility and support options before committing to a rebuild.
- Fixed quotes before we start. No hourly surprises during an incident.
- One point of contact from first call to final report.
A typical engagement
Assess
Review your systems, evidence and business-critical flows.
Agree
Confirm scope, access, timing, quote and rollback plan.
Deliver
Implement, test and document the work and remaining risks.
Incident investigation & forensics
Has your application already been compromised?
We can investigate signs of a breach using server and application logs, access records, file changes, database activity and available backups. We look for unauthorized access, web shells, persistence and evidence of data access or extraction.
You receive an evidence-based incident timeline, the systems and accounts we believe are affected, our confidence and evidence gaps, and prioritized steps for containment, recovery and preventing recurrence.
A clean version check does not rule out an earlier compromise. Missing or incomplete evidence can prevent a definitive answer; we explain what we can establish and what remains unknown.
Explore incident investigationNot just PHP
Any runtime that ships security fixes deserves the same discipline. We keep Node.js, Python, Java, .NET and Ruby stacks patched, hardened and documented — so the next critical CVE finds you ready, not scrambling.
We also help migrate applications away from PHP. Secure what you run today, then choose whether to modernize your PHP application or move to a different stack.
Questions we hear every day
How do I know if my site is affected?
If you run PHP 8.2.x before 8.2.35, 8.3.x before 8.3.36, 8.4.x before 8.4.27, or 8.5.x before 8.5.12, your upstream version predates the fix. Vendor backports can retain older version numbers, including on legacy branches. Verify your package with your provider. Use our free checker or just ask us — we'll look with you.
My host says they handled it. Should I still check?
Yes. "Managed" hosting often means the OS is patched but your app's PHP runtime — a container, a Plesk vhost, a composer-installed runtime — is not. We verify every place PHP actually executes, not just the server's package manager.
Can you patch without breaking my application?
We agree backups, a staging test plan and rollback steps before a production change. We test critical application flows and explain compatibility risks; no upgrade is risk-free.
What does it cost?
Scope depends on your systems, compatibility requirements and available evidence. We agree deliverables, timing and a written quote before work begins. Incident investigation and longer-term migration can be scoped separately.
Is this only about PHP?
No. The same discipline — inventory, patch, shield, verify — applies to any runtime that ships security fixes: Node.js, Python, Java, .NET and more. PHP is simply where we have the deepest scars.
Can you tell if we have already been breached?
We can investigate signs of a breach using server and application logs, access records, file changes, database activity and available backups. We look for unauthorized access, web shells, persistence and evidence of data access or extraction. A clean version check does not rule out an earlier compromise. Missing or incomplete evidence can prevent a definitive answer; we explain what we can establish and what remains unknown.
Can you help us move away from PHP?
Ready to move your application to a different technology stack? We can help assess your options and plan and deliver the migration, including your existing features, data and integrations. An urgent security fix does not have to become a full rewrite. We can help you address immediate risk and plan a migration separately, at a pace that fits your business.
Get a clear plan for your application.
From an urgent patch to a suspected breach or a planned migration, start with your situation. We will agree the next steps, scope and timing with you.