- Home
- ServicesSoftware Engineering
- Custom SaaS DevelopmentNewMulti-tenant, billing, SOC 2-ready, AI-native.
- Next.js DevelopmentProduction Next.js 15 with App Router, RSC & edge.
- Python & FastAPIHigh-performance APIs, microservices, AI inference.
- Mobile App DevelopmentNewReact Native & Flutter — iOS + Android.
- Web ApplicationsFull-stack web apps, portals & dashboards.
- Custom SoftwareBespoke software, sprint delivery, real PMs.
AI & Data- AI Agent DevelopmentLangChain, OpenAI Agents SDK, Claude — RAG + tools.
- Custom RAG DevelopmentNewHybrid search, reranking, evals & citations.
- MCP Server DevelopmentNewExpose your tools to Claude, Cursor, ChatGPT.
- AI Workflow AutomationNewn8n + AI with Telegram, WhatsApp, Slack.
- AI & ML DevelopmentComputer vision, predictive analytics, fine-tuning.
18 years · 1,000+ projects · 60+ engineers · Toronto HQ - Case Studies
- Clients
- About
- Compare
- Insights
- Blog
- Career
- Contact
Quick answer
On 21 October 2026 PHP released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2), which can let an attacker run code on a PHP server without logging in. Updating WordPress or Laravel does not fix them: PHP itself must be updated and restarted. UnlockLive IT does it for you: we check every server, update PHP the right way for your setup, restart it, test your site and send you a short written report. If you are on an old PHP version with no official fix, we upgrade you safely.
Want to do it yourself? Read our step-by-step guide: PHP vulnerability October 2026: what to do now.
What we do
Find every PHP install: Production, staging, old forgotten sites and containers: which PHP version each one runs, how it is installed and whether the fixes are in.
Patch the right way for your setup: Shared hosting, cPanel or Plesk, your own Ubuntu, Debian or Red Hat server, Docker images or Kubernetes: updated to 8.5.12, 8.4.27, 8.3.36, 8.2.35 or your vendor's patched package.
Restart and verify: Every PHP-FPM pool, Apache and web server restarted, so no worker keeps running the old code, then checked again.
Test your site: Logins, forms, uploads, checkout and payments tested after the update, with a quick rollback plan ready.
Temporary protection if needed: If you cannot update today, we apply the PHP team's recommended settings at server level and plan the real fix.
Upgrade from old PHP: PHP 7.4, 8.0 and 8.1 get no official fix. We move your site to PHP 8.3 or 8.4 on a staging copy first, fix the code and plugins, then switch.
Simple fixed prices
Emergency patch
From $149 per server
Check, update PHP, restart, test the site and a short written report. Usually done the same day.
Old PHP upgrade
From $990 per site
PHP 7.4, 8.0, 8.1 or 8.2 to PHP 8.3/8.4, tested on a staging copy first, with code and plugin fixes.
Ongoing PHP care
From $99 a month per server
Security updates applied as they are released, monthly checks and an alert when something needs your decision.
Book a free 30-minute call or send us your site address
Who we help
How it works
- Send us your site address: Or book a free 30-minute call. We tell you honestly whether you are likely affected and what it takes to fix.
- Safe access: You give us temporary access to the server or hosting panel. We never ask for passwords by email; we agree a secure way first.
- Backup, patch, restart: A backup or snapshot first, then the PHP update for your setup, then a restart of every PHP worker.
- Test and report: We test the important pages and flows and send you a short report: what was found, what was changed, and what to plan next.
Frequently asked questions
Which PHP versions are affected by CVE-2026-109618 and CVE-2026-109619?
Every PHP installation that serves web requests and has not been updated to 8.5.12, 8.4.27, 8.3.36, 8.2.35 or a vendor package with the fixes. That includes PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP 8.1 and older get no official fix.
Will updating PHP break my website?
A security update within the same branch, for example 8.3.30 to 8.3.36, rarely changes behaviour. We still take a backup or snapshot first, test logins, forms and payments afterwards, and keep a rollback ready. Moving from an old version such as 7.4 to 8.3 is a bigger change, so we do that on a staging copy first.
How fast can you fix it?
Most single-server updates on a supported PHP version are done the same day: around one to two hours of work per server, including testing. We start as soon as we have safe access to the server or hosting panel.
I am on shared hosting. Can you still help?
Yes. On shared hosting the host controls PHP, so we check your version, switch you to a patched or newer version in the control panel where possible, test the site, and contact the host for you if they need to act.
What do you need from me?
Your site address, and temporary access to the server or hosting panel through a secure method we agree on the call. We never ask for passwords by email, and we remove our access when the work is done.
Do you offer ongoing PHP security updates?
Yes. Our PHP care plan applies PHP and server security updates as they are released, checks your servers monthly and tells you when an upgrade needs a decision, such as PHP 8.2 reaching end of life on 31 December 2026.
Have a different question? Book a free strategy call.
Not sure if your PHP sites are safe?
Send us your site address. An engineer replies the same business day with what to do.
Get my PHP sites checkedPractical guides on this topic
UnlockLive IT Limited — Toronto client-facing HQ and project management; dedicated engineering center in Dhaka, Bangladesh. UK registered company #15563368 (UnlockLive IT Limited, London).
Copyright© UnlockLive .All right reserved 2008 - 2026