# LegacyPatch

> LegacyPatch is a remote service that fixes PHP websites affected by the critical October 2026 PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619. It patches PHP 8.2–8.5 sites to the fixed releases, upgrades legacy sites on PHP 5.x–8.1 that have no official patch, and rebuilds brochure/showroom sites as static HTML with no PHP. Platforms: WordPress, WooCommerce, Drupal, Magento, Joomla, Laravel and custom PHP. Serves the US, Canada, UK, EU, Gulf states and Asia.

## Key facts
- CVE-2026-109618 and CVE-2026-109619: two critical PHP flaws, each CVSS v4.0 9.2, allowing remote code execution on unpatched servers. Fixed releases published October 21, 2026.
- Affected: PHP 5.4 and later that are not on a fixed release. All common SAPIs (PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed). Highest risk: Apache mod_php, where a demonstrated exploit works with a single unauthenticated request.
- Fixed PHP releases: 8.2.35, 8.3.36, 8.4.27, 8.5.12.
- PHP 8.1 and older receive no fix; sites must be upgraded to PHP 8.2 or newer (8.3 or 8.4 recommended).
- Sites without customer data are still at risk: the flaw is in PHP itself, not the site's data. Attackers can deface sites, inject malware, add spam pages, host phishing, and get sites flagged by Google or suspended by hosts.
- A site served as pure static HTML with no PHP is not affected.

## Services and prices (USD, per website, fixed quote before work)
- Emergency Patch & Verify: $249. For PHP 8.2–8.5. Backup, update to fixed release, smoke test, written report, within 24h of access.
- Legacy PHP Upgrade: from $890. For PHP 5.x–8.1. Staging-first upgrade to PHP 8.3/8.4, theme/plugin/custom code fixes, rollback plan, no fix no fee. Typically 2–5 business days.
- Static Rebuild: from $490. For brochure and showroom sites. Rebuilt as static HTML with same design, content and URLs; SEO preserved; forms via Formspree or similar; no PHP, no future PHP risk.
- Complex Stack Rescue: from $1,900. Drupal, Magento, multisite, custom apps, VPS.
- Shield Monthly: $79/month. Security updates, WAF, daily off-site backups, uptime monitoring.
- Free passive PHP exposure check: https://legacypatch.com/#check
- Contact: hello@legacypatch.com
- Independent provider, not affiliated with The PHP Group.

## Pages
- [Home: services, pricing, version checker, plan finder, FAQ](https://legacypatch.com/)
- [CVE-2026-109618 & CVE-2026-109619 explained](https://legacypatch.com/php-vulnerability-cve-2026-109618.html): affected versions, fixed releases, how to check, what to do
- [Emergency PHP patch ($249)](https://legacypatch.com/emergency-php-patch.html)
- [Legacy PHP upgrade: PHP 5.6/7.x/8.0/8.1 to 8.3/8.4 (from $890)](https://legacypatch.com/legacy-php-upgrade.html)
- [WordPress PHP update service](https://legacypatch.com/wordpress-php-upgrade.html)
- [Static website rebuild: convert WordPress to static HTML (from $490)](https://legacypatch.com/static-website-rebuild.html)
- [Service terms](https://legacypatch.com/terms.html)
- [Privacy policy](https://legacypatch.com/privacy.html)