Your website runs on PHP. Is it on a patched version?
Two critical PHP flaws (CVSS 9.2) let attackers run code on unpatched servers. We patch supported versions within 24 hours, upgrade old PHP 5.x–8.1 sites that cannot be patched at all, and rebuild showroom sites with no PHP to attack.
Request received
We'll email your PHP status report within a few hours. Check your inbox (and spam folder) for a message from hello@legacypatch.com.
Is my PHP version vulnerable? Check in two seconds.
Where your site lands depends on which PHP version it runs today. Type yours in for an instant answer.
Enter your PHP version, or tap one above.
Not sure which sub-release you're on? Hosting panels often show only "8.2". Send us your URL and we'll find out.
CVSS v4.0 score for each of the two flaws
Every PHP release since 5.4 is affected until patched
Unauthenticated request needed by the demonstrated mod_php exploit
Official patches for PHP 8.1 and older
No customer database? Still a target.
The flaw is in PHP itself, in how the server handles incoming requests, not in your data. On Apache mod_php, the attack works with a single request before your website's own code even runs. Any server on vulnerable PHP is exposed.
Defaced site
Your homepage replaced, or malware injected that infects every visitor.
Spam pages, lost rankings
Thousands of hidden spam pages added to your domain wreck your Google ranking.
Phishing on your domain
Fake bank or login pages hosted under your business name.
Flagged by Google
A full-screen browser warning sends your visitors away.
Suspended by your host
Compromised accounts get shut down, along with your email.
The exception: pure HTML
A site with no PHP on the server isn't affected. That's our Static Rebuild →
Which fix does my site need?
Three quick answers, one recommendation. No email needed.
Answer the questions to see your recommended fix.
Patch vs. upgrade vs. static rebuild
| Emergency Patch | Legacy PHP Upgrade | Static Rebuild | |
|---|---|---|---|
| Best for | Sites on PHP 8.2 – 8.5 | Sites on PHP 5.x – 8.1 | Brochure & showroom sites |
| Fixes CVE-2026-109618 & 109619 | Yes | Yes | Yes |
| Protected from future PHP flaws | If kept updated | If kept updated | Yes, no PHP |
| Keeps CMS admin, shop & logins | Yes | Yes | No |
| Typical turnaround | Within 24h of access | 2 – 5 business days | Quoted by page count |
| Price | $249 | from $890 | from $490 |
Fixed prices. Quoted before we touch anything.
All prices in USD per website. GBP and EUR invoices on request.
Emergency Patch & Verify
Your site is on PHP 8.2+ and needs the fixed release.
- Full backup first
- Update to the fixed PHP release
- Site-wide smoke test
- Written verification report
- Done within 24h of access
Legacy PHP Upgrade
Your site is stuck on PHP 5.x – 8.1.
- Staging copy, live site untouched
- Fix themes, plugins & custom code
- Move to patched PHP 8.3 or 8.4
- Rollback plan
- No fix, no fee
Static Rebuild
Brochure and showroom sites that don't need PHP at all.
- Same design, content & URLs
- SEO kept: redirects, metadata, sitemap
- Contact form via Formspree or similar
- Fast static hosting setup
- No PHP, no future PHP risk
Complex Stack Rescue
Drupal, Magento, multisite, custom apps, VPS.
- Senior engineer assigned
- Server-level PHP rebuild
- Dependency & Composer fixes
- Compromise check
- Scoped quote in 24h
Shield Monthly
So the next critical flaw isn't an emergency.
- Security updates applied
- Firewall (WAF) setup
- Daily off-site backups
- Uptime monitoring
- Cancel anytime
The safest PHP is no PHP.
A brochure site (pages, photos, contact form) doesn't need PHP. We rebuild it as plain static HTML with the same look and the same URLs. It's immune to these CVEs and to every future PHP flaw, loads faster, and costs almost nothing to host.
- Nothing to patch: no PHP, no plugins, no database, no admin login to attack
- Pages served straight from a CDN, so they load fast
- Free-tier static hosting is often enough for a small business site
- URLs, metadata and redirects preserved, so your Google rankings carry over
From "are we exposed?" to fixed, in four steps
Nothing changes on your site until you've approved a fixed price and timeline.
Free check
Send your URL. We report your PHP status and exposure.
within hoursFixed quote
You approve a fixed price and timeline. Nothing starts before that.
same daySafe access
A temporary account via an encrypted one-time link. Never your main password.
5 minutesFix & report
Backup, fix, test, written report. Access removed when done.
24h – 5 daysWhy "just update PHP" often breaks sites
Jumping from PHP 7.4 or 8.0 to 8.3 removes functions old themes and plugins rely on. Click the button in your hosting panel and you can get a blank page or a broken checkout.
For custom code, we find every incompatible line with PHPCompatibility and Rector and rewrite it in modern PHP. For WordPress, Drupal or Magento, core and plugins are updated, not rewritten. Only your custom theme and snippets get fixed. All on staging first.
- Staging copy first. Your live site keeps running untouched.
- Every theme, plugin and custom file scanned for incompatible code
- Tested rollback plan before the live switch
// Fatal error on PHP 8: each() was removedwhile (list($k, $v) = each($opts)) {foreach ($opts as $k => $v) {// Fatal error on PHP 8: create_function() removed$cb = create_function('$a', 'return $a * 2;');$cb = fn($a) => $a * 2;// Fatal error on PHP 7+: mysql_* extension removed$r = mysql_query("SELECT * FROM leads");$r = $pdo->query("SELECT * FROM leads");// Deprecated in PHP 8.2$name = utf8_encode($row['name']);$name = mb_convert_encoding($row['name'], 'UTF-8', 'ISO-8859-1');
Built for people who don't hand out their passwords
We're a security service. We work like one.
Temporary, dedicated access
A dedicated SFTP, hosting or CMS user, never your main password. Removed when the job ends.
Encrypted one-time links
Credentials travel through an encrypted link that works once. We delete our copies when the job closes.
Full backup before any change
Files and database are backed up before we touch a line, so there's always a way back.
Passive checks only
Our free check reads public version signals. We never fire attacks at your site.
Written authorization
We only work on sites you own or are authorized to manage, confirmed in writing before we download a single file.
Who we help
Site owners in the US, Canada, the UK, the EU, the Gulf and Asia.
PHP security fixes for every major platform
Questions site owners are asking
Is my website affected by the October 2026 PHP vulnerabilities?
If your site runs PHP 5.4 or later and is not on PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or newer, it is potentially affected by CVE-2026-109618 and CVE-2026-109619. WordPress, Drupal, Joomla and Magento sites all run on PHP.
Is it only websites with customer databases that are at risk?
No. The flaw is in PHP itself, in how the server handles incoming requests, not in the site's data. On the riskiest setup, Apache mod_php, the attack works with a single request before the website's own code even runs. Any server running vulnerable PHP is exposed, whether it stores customer data or nothing at all.
I have a simple showroom or brochure website. Am I affected?
Yes, if the site runs on PHP, which every WordPress site does. You lose no customer data because there isn't any, but an attacker who takes the server can deface the site or inject malware that infects visitors, add hidden spam pages that wreck your Google ranking, host phishing pages on your domain, and get the site flagged by Google or suspended by your host. A showroom site that's pure HTML with no PHP is not affected.
My site runs PHP 7.4 or 8.1. Can it be patched?
No official patch exists for PHP 8.1 and older. The fix is to upgrade to PHP 8.2 or newer, which usually requires updating or repairing themes, plugins and custom code first. That is our Legacy PHP Upgrade service. For brochure sites, a Static Rebuild removes PHP entirely.
What is a static rebuild, and is it right for my site?
A static rebuild turns a WordPress or PHP brochure site into plain HTML files with the same design, content and URLs. With no PHP on the server it's immune to these and future PHP vulnerabilities, loads faster and costs almost nothing to host. It suits showroom and brochure sites, but not online stores, booking systems or member areas. Static Rebuild starts at $490.
Won't my hosting company fix this automatically?
Many managed hosts patch their own PHP builds, but only for the PHP versions they still support. If your site is pinned to an old PHP version, runs on a VPS or dedicated server, or uses a custom stack, you are usually responsible for the upgrade.
How much does it cost to fix?
Emergency Patch & Verify is $249 for sites on PHP 8.2–8.5. Legacy PHP Upgrade for PHP 5.x–8.1 starts at $890 with no fix, no fee. Static Rebuild for brochure sites starts at $490. Complex Stack Rescue for Drupal, Magento, custom apps and VPS starts at $1,900. Shield Monthly care is $79 a month. Every job gets a fixed quote before work starts.
How fast can you patch my site?
Emergency Patch & Verify jobs on supported PHP versions are usually completed within 24 hours of receiving access. Legacy upgrades typically take 2–5 business days because we test on a staging copy first.
Can you just rewrite my old PHP code?
For custom code, yes. We scan with PHPCompatibility and Rector, find every incompatible line, and rewrite it in modern PHP. For WordPress, Drupal or Magento, most of the site is core and third-party plugins, which are updated to PHP 8-compatible versions rather than rewritten. Only the custom theme, custom plugins and snippets are fixed. Everything is tested on staging before going live.
How do I give you access safely?
We create a temporary user account or ask you to add a dedicated SFTP or hosting user, never your main password. Credentials are shared through an encrypted one-time link and access is removed when the job ends.
What do you need from me to get started?
Your website address for the free check. To do the work, we need your written confirmation that you own the site or are authorized by its owner, a fixed quote you've approved, and a temporary access account.
Do you work outside the United States?
Yes. We work remotely with site owners in the US, Canada, the UK, the EU, the Gulf states and Asia. Prices are in USD; invoices in GBP or EUR are available on request.
Find out where your site stands in a few hours
Send your URL. Get a plain-English answer and a fixed quote if you need one.