£999 Emergency PHP Patch

Your PHP version, moved to the fixed point release for CVE-2026-109618 and CVE-2026-109619 — same working day where possible, with a backup, a staging test and a smoke test around the change.

Needs a site on PHP 8.2–8.5 you can give us access to, and a backup taken before we start.

Book the £999 patchAll PHP Update Services

What's Included

Full backup taken before anything changes
Update to the fixed point release for your PHP version
Staging test before production
PHP-FPM / worker restart so the fix takes effect
Smoke test of your site after the change
Written summary of what changed and what was verified
Highest-priority queue — same or next working day
Optional add-ons at booking: plugin & theme compatibility pass (£149, flat — any number of plugins) and staging environment setup (£249) for sites without staging. Both are checkboxes on the booking form.

Fixed Point Releases (21 Oct 2026)

PHP branchFixed releaseStatus
PHP 8.58.5.12supported
PHP 8.48.4.27supported
PHP 8.38.3.36supported
PHP 8.28.2.35end of life 31 Dec 2026

What the Patch Doesn't Cover

Site moving off PHP 8.1 or older — no upstream fix exists, that's an upgrade
Managed hosting stacks — your host must apply or approve the change, we guide them
Malware detection or compromise cleanup — patching closes the hole, it doesn't investigate
Plugin or theme fixes caused by the PHP change — covered by the optional compatibility pass
Framework or PHP version upgrades — different job

Frequently Asked Questions

Will my site go down?+

The change is applied on staging first, then production with a backup ready to restore. Brief worker restarts are possible, but downtime is not expected and, if anything goes wrong, the backup brings the site straight back.

Why is the plugin pass separate?+

The £999 patch is a controlled PHP update: it fixes the vulnerability and verifies your site still works. If a plugin or theme misbehaves after the PHP change, fixing it is extra engineering with an unpredictable count — so it's a flat £149 add-on that covers any number of plugins, rather than per-plugin billing.

What if my PHP version has no point release?+

Versions below 8.2 got no fix, so patching isn't possible — you need an upgrade or a vendor backport. Book the £149 check and the report will say exactly that, with the upgrade quoted.

What if I'm already patched?+

PHP versions at or above the fixed release (8.5.12, 8.4.27, 8.3.36, 8.2.35) are already safe. The £149 check confirms your exact version and configuration before you spend more.

How quickly can you patch?+

Same or next working day from booking — the queue is first-come-first-served and emergency patches are scheduled ahead of routine work. The £149 check is waived if you've already booked the patch: it runs as the first step of the job.

Does patching remove an existing compromise?+

No — patching closes the hole but doesn't evict anything already inside. If you suspect the site was hit before patching, say so when you book: we can review logs and file changes as part of an emergency job and report honestly what we could and couldn't confirm.

Book the Emergency Patch

Secure your place in the queue and we'll email the next steps. Not sure of your exact PHP version? Start with the £149 check instead.

Book the £999 patchStart with the £149 check