If your site runs PHP 8.2, 8.3, 8.4 or 8.5, an official fix exists: update to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or newer. Our Emergency Patch & Verify service does it for a fixed $249, including a full backup, the update, a site-wide test and a written report, usually within 24 hours of receiving access.
Which PHP versions does the emergency patch cover?
Only PHP branches that received an official fix on October 21, 2026:
| Your branch | Patched release | Service |
|---|---|---|
| 8.5.x | 8.5.12 | Emergency Patch · $249 |
| 8.4.x | 8.4.27 | Emergency Patch · $249 |
| 8.3.x | 8.3.36 | Emergency Patch · $249 |
| 8.2.x | 8.2.35 | Emergency Patch · $249 |
| 8.1 and older | No official fix | Legacy upgrade |
On PHP 8.1, 8.0, 7.x or 5.x? No patch exists for you. See the Legacy PHP Upgrade or, for brochure sites, the Static Rebuild.
How we patch PHP without breaking your site
- Backup. Full copy of files and database, stored off the server.
- Identify the real runtime. We confirm which PHP build actually serves your site (PHP-FPM, Apache mod_php, LiteSpeed LSAPI, php-cgi or FrankenPHP), not just the command-line version.
- Update. Through your hosting panel, your OS package manager, or by rebuilding the PHP package on a VPS, then restarting PHP-FPM or the web server.
- Verify. We confirm the new version is live, without leaving a public
phpinfo()file behind. - Smoke test. Home page, key templates, forms, search, checkout and admin login.
- Report. Before and after versions, what we tested, and anything suspicious we noticed.
Why mod_php servers should patch first
The PHP developers rate the risk highest for Apache mod_php, where a demonstrated exploit works with a single unauthenticated request. It runs before your website's own code, so a login page, a plugin or a firewall inside WordPress won't stop it. If your server uses mod_php, treat this as same-day work.
# Is Apache loading mod_php? $ apachectl -M 2>/dev/null | grep -i php
Shared hosting vs VPS: who has to patch?
On managed or shared hosting, your host usually ships the patched PHP build for supported branches, but you may still need to switch your account to it, and many accounts stay pinned to an old version. On a VPS or dedicated server you are responsible for the update yourself. Custom builds, old Linux distributions and Docker images often need a rebuild. That's where our Complex Stack Rescue takes over.
After the patch: stay protected
- Keep a web application firewall (WAF) in front of the site. Cloudflare reported deploying rules against attack traffic for these flaws.
- Review admin and server accounts for anything you don't recognize.
- Put updates on autopilot with Shield Monthly ($79/mo), so the next critical flaw isn't an emergency.
Frequently asked questions
How much does an emergency PHP patch cost?
A fixed $249 per website for sites already on PHP 8.2, 8.3, 8.4 or 8.5. It includes a full backup, the update to the fixed release, a site-wide smoke test and a written verification report.
How fast can you patch PHP?
Usually within 24 hours of receiving access. Sites on Apache mod_php are prioritized because the demonstrated exploit needs only a single unauthenticated request.
Will updating PHP break my website?
Moving within the same branch (for example 8.3.20 to 8.3.36) is a security and bug-fix update and rarely breaks sites. We still take a full backup first and test key pages afterwards. Jumping between major versions (7.4 to 8.3) is different. That's our Legacy PHP Upgrade.
My host says they patched PHP. Am I safe?
Only if your site actually runs on the patched build. Many accounts stay pinned to an older branch or sub-release. Use our free check and we'll confirm the version your site is really serving.
Do you need my main hosting password?
No. We ask for a dedicated, temporary hosting, SFTP or server user, shared through an encrypted one-time link. Access is removed when the job ends.
Patched today, with proof in writing
Fixed $249. Backup, update, test, report. Within 24 hours of access.
Related services
Last updated October 22, 2026. LegacyPatch is an independent service provider and is not affiliated with The PHP Group. Prices in USD; GBP and EUR invoices on request.