Know your server is really patched, not just labelled that way
After the October 2026 PHP flaws (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2), a version number is no longer proof of anything. We check the evidence on your hosting account or VPS: the build date, the package changelog and the PHP workers that are actually running.
If your PHP is unsupported or your code breaks on a newer version, we upgrade it on a staging copy first, then switch the live site and check the result. If you suspect someone got in before the patch, we look for that too.
What's Included
- PHP patch verification from build date and changelog
- Check of running PHP-FPM workers and restarts
- Temporary mitigations when an update must wait
- Exposed file and phpinfo() sweep
- PHP upgrade tested on a staging copy
- Fixes for deprecated and broken code
- Post-patch checks of files, cron jobs, admin users and logs
- Credential rotation and clean-restore advice
Common Questions
My PHP version number looks old. Am I affected?
Not necessarily. Hosts and Linux distributions often put security fixes inside an older version number. We verify from the build date or the package changelog instead of the label.
Do I need this on managed hosting?
Your host patches PHP, but you should still verify the fix, stay on a supported version and check your own site. PHP 8.2 official security support ends on December 31, 2026.
Can you upgrade old PHP code that breaks?
Yes. We test on a staging copy, fix compatibility problems such as deprecated syntax, and only then switch the live site.
What if I think I have already been hacked?
Tell us straight away and keep your logs. We check files, cron jobs, admin users and logs, and advise on cleaning versus restoring from a clean backup.
Ready to start?
Book a free 30-minute discovery call and get a clear scope, timeline and quote.