Services
PHP security, incident forensics and application migration
PHP is our home turf — but our playbook works for any language that ships security fixes. Here's what we do, and how we do it: engineers, fixed quotes, verified results. We can also help you migrate your application away from PHP.
Emergency CVE response
A critical vulnerability just dropped — like PHP2Shell. We inventory your exposure, shield what we can immediately, and patch on an agreed timeline, with verification and a documented account of the work and remaining risks.
PHP version upgrades
Moving from 5.6, 7.x or 8.1 to a supported release without breaking your application — compatibility fixes, dependency updates and staged rollouts included.
Server & runtime hardening
Web server configuration, TLS, header discipline, opcode and FPM tuning, WAF deployment, and removal of leaky leftovers like exposed phpinfo pages.
Code-level security review
A senior engineer reads your application the way an attacker would: injection points, auth flows, file handling, dependency risk — with concrete fixes, not a 200-page PDF.
Ongoing security maintenance
A monthly retainer: we track advisories for your stack, apply patches on schedule, and tell you in plain language what changed and why.
Incident investigation & forensics
We can investigate signs of a breach using server and application logs, access records, file changes, database activity and available backups. We look for unauthorized access, web shells, persistence and evidence of data access or extraction.
Has your application already been compromised?
We can investigate signs of a breach using server and application logs, access records, file changes, database activity and available backups. We look for unauthorized access, web shells, persistence and evidence of data access or extraction.
1. Preserve & scope
Agree authorized access, affected systems and evidence handling. Preserve available logs and snapshots alongside containment.
2. Investigate
Correlate access, file and application activity to assess entry points, persistence and possible impact.
3. Recover & report
Document findings, confidence and gaps. Plan credential rotation, cleanup or rebuilds, fixes and follow-up monitoring.
You receive an evidence-based incident timeline, the systems and accounts we believe are affected, our confidence and evidence gaps, and prioritized steps for containment, recovery and preventing recurrence.
A clean version check does not rule out an earlier compromise. Missing or incomplete evidence can prevent a definitive answer; we explain what we can establish and what remains unknown.
If you suspect an incident, contact your hosting provider or incident response team promptly. Coordinate containment and preserve available logs and snapshots before cleanup where possible. Do not upload credentials, customer data or forensic evidence through this form.
Discuss a suspected compromiseMigrate away from PHP
Ready to move your application to a different technology stack? We can help assess your options and plan and deliver the migration, including your existing features, data and integrations.
An urgent security fix does not have to become a full rewrite. We can help you address immediate risk and plan a migration separately, at a pace that fits your business.
Discuss a PHP migrationAny language. Same discipline.
Every runtime that ships security fixes gets the same treatment: inventory, patch, shield, verify, document. When the next critical advisory lands — for PHP or anything else — you'll have a team that already knows your stack.
How we price
- Patching: scoped by runtime count, hosting access and rollout requirements.
- Investigation: scoped by affected systems, available evidence and the period under review.
- Upgrades and migration: discovery, compatibility work and delivery milestones agreed up front.
- Ongoing support: coverage, response expectations and commercial terms agreed in writing.
Not sure what you need?
Describe your setup in two sentences. We'll tell you honestly what it needs — with the evidence and limits behind our recommendation.
Ask an engineer