Critical vulnerabilities in your stack? We patch them for $29.99.
Newly disclosed flaws in PHP, Next.js, Nginx, WordPress, Splunk and Linux can let attackers take over servers and websites. Our engineers check, update and verify each one, then send you a written report. One flat price per instance, website or application.
One-time fee. No contract. More than 5 servers? Contact support for volume pricing.
Six critical releases. Anything below the fixed version is exposed.
Updating is the only complete fix. Configuration workarounds only narrow specific attack paths.
Unauthenticated remote code execution in PHP 8.2 to 8.5 and older.
Fixed in: 8.5.12, 8.4.27, 8.3.36, 8.2.35 (21 Oct 2026). PHP 8.1 and older have no official fix.
See PHP patching →Two critical unauthenticated RCEs, including one in SVG image processing.
Fixed in: 16.4.1 and 15.5.28 (14 Oct 2026)
See Next.js patching →Heap buffer overflow in the rewrite module.
Fixed in: 1.31.1 and 1.30.2 (Open Source)
See NGINX patching →A chain leading to unauthenticated RCE. Forced auto-updates were enabled.
Fixed in: 7.0.2 (17 Jul 2026), 7.0.3 (6 Aug 2026)
See WordPress updates →CVE-2026-20253 is exploited in the wild.
Fixed in: latest Splunk Enterprise releases per the vendor advisories
See Splunk patching →A use-after-free in the traffic control subsystem, plus other critical kernel fixes.
Fixed in: kernels 6.6.145, 6.1.178 and 5.15.212 or later
See Linux OS patching →The same runbook for every service, carried out by our engineers.
Audit
Identify your version and setup, and check the applicable security advisories.
Back up
Back up the relevant configuration, files or database before anything changes.
Patch
Apply the available security updates through standard or authorized repositories.
Restart and validate
Validate the configuration and restart or reload affected services where required.
Verify
Confirm the patched versions and basic functionality or service health.
Report
You receive a written summary of the changes made and any remaining risks.
Pick the service that matches your stack. $29.99 each.
Every service is a one-time fee with no contract. Updates or patching already covered under an existing Server Management and Maintenance (SMM) agreement are provided at no additional charge.
Our server engineers update, harden and verify each PHP instance end to end, including Apache with mod_php, PHP-FPM, php-cgi, LiteSpeed and FrankenPHP.
- Full audit of PHP versions, handlers, pools and package sources
- Interim hardening where an update cannot go in immediately
- Update to the fixed PHP release: 8.5.12, 8.4.27, 8.3.36 or 8.2.35
- Graceful restart of every worker so no process runs the vulnerable build
- Verification and smoke testing of your sites
- Written patch report with before and after versions
- PHP 8.1 and older have no official release: we apply your vendor's LTS fix or the PHP security team's backport and advise on upgrading.
- More than 5 servers? Contact support for volume pricing.
Keep your NGINX web server protected against known security vulnerabilities with expert patching. Our engineers identify applicable security updates, apply available patches and verify that your web server is functioning correctly.
- Check the installed NGINX version and applicable security advisories
- Back up relevant configuration files where applicable
- Apply available security patches through standard distribution repositories
- Validate the NGINX configuration and reload or restart the service if required
- Verify service availability after patching
- Provide a summary of the changes made
Applies only to supported, non-EOL servers running NGINX managed through standard distribution repositories.
- The package covers security patching within the defined scope only.
- Custom NGINX builds, unsupported versions, major upgrades and complex troubleshooting are excluded.
- Any additional work required beyond the defined scope may be quoted separately.
Outdated WordPress core files, plugins and themes can expose websites to security vulnerabilities. Bobcares helps you apply available security updates to affected components and verify basic website functionality after patching.
- Review the WordPress version and installed plugins and themes
- Identify applicable security updates
- Back up website files and database where supported
- Update eligible WordPress core, plugins and themes to appropriate patched versions
- Verify website availability and basic functionality
- Provide a summary of updates completed
Applies only to websites hosted on supported, non-EOL servers, with WordPress components managed through standard or authorized update repositories.
- A valid license may be required for premium plugins and themes.
- Major upgrades, custom development, compatibility fixes and malware cleanup are excluded.
- Additional troubleshooting or recovery work may be quoted separately.
Unpatched operating systems may expose servers to security vulnerabilities, privilege escalation and service disruption. Bobcares helps you apply relevant Linux security updates through supported package repositories and verify the server's basic health after patching.
- Identify the Linux distribution and installed release
- Check applicable security advisories and available package updates
- Apply eligible security patches through standard distribution repositories
- Restart affected services where required
- Identify whether a server reboot is necessary
- Verify package versions and basic server health
- Provide a patch completion report
Applies only to supported, non-EOL Linux servers managed through standard distribution repositories.
- EOL operating systems, custom kernels, major OS upgrades and unsupported packages are excluded.
- Reboots and service restarts are handled in accordance with the agreed change scope.
- Complex remediation and recovery work may require a separate quote.
Keep your Next.js application protected against known framework and dependency vulnerabilities. Bobcares helps identify applicable security fixes, update affected packages and verify the application through an agreed validation process.
- Review the installed Next.js version and relevant dependencies
- Check applicable security advisories and identify available fixes
- Update affected packages to compatible, patched versions
- Run an agreed build or basic validation test
- Verify application functionality within the agreed scope
- Provide a summary of the changes made
Applies only to applications running in supported, non-EOL environments, with dependencies managed through standard or authorized package repositories.
- Access to the application source code and dependency manifests is required.
- Major framework migrations, extensive code changes, dependency conflicts and redevelopment are excluded.
- Production deployment is included only when explicitly agreed as part of the scope.
- Additional troubleshooting may be quoted separately.
Outdated WordPress plugins can introduce security risks to websites. Bobcares helps update Rank Math PRO to an appropriate patched version when a relevant update is available and verifies basic website functionality after the update.
- Check the installed Rank Math PRO version
- Review applicable security advisories and available updates
- Confirm license and update access
- Back up relevant files and configuration where supported
- Apply the eligible plugin update
- Verify basic website functionality
- Provide a completion report
Applies only to websites hosted on supported, non-EOL servers, with Rank Math PRO updates available through authorized distribution channels.
- A valid Rank Math PRO license and access to the required update package are necessary.
- License purchase or renewal, plugin conflicts, malware cleanup and extensive website repairs are excluded.
- Additional troubleshooting may be quoted separately.
Keep your Splunk installation protected by identifying applicable security advisories and updating affected components to vendor-supported fixed versions. Bobcares helps plan and apply eligible updates and verify basic service health.
- Identify the installed Splunk product, version and deployment role
- Review applicable Splunk security advisories
- Check update prerequisites and compatibility requirements
- Back up relevant configuration where supported
- Apply an appropriate vendor-supported security update within the agreed scope
- Verify service health and basic functionality
- Provide a summary of the remediation completed
Applies only to supported, non-EOL Splunk installations eligible for updates through official vendor-supported distribution channels.
- Distributed deployments, clustered upgrades, major version migrations and complex multi-node changes are excluded from the standard package.
- Vendor licensing and additional troubleshooting are not included.
- Additional work may be quoted separately based on the deployment and remediation requirements.
Outdated Node.js runtimes and vulnerable dependencies can expose applications to security risks, including remote code execution, unauthorized access and service disruption. Bobcares helps identify applicable security updates, patch affected components and verify basic application functionality.
- Identify the installed Node.js version and relevant dependencies
- Review applicable Node.js security advisories and available fixes
- Update the Node.js runtime or affected dependencies to compatible, patched versions where applicable
- Apply updates through standard or authorized package repositories and package managers
- Run basic application or build validation within the agreed scope
- Verify application functionality after patching
- Provide a summary of changes and any outstanding risks
Applies only to applications running on supported, non-EOL servers and environments, with Node.js managed through standard or authorized distribution channels.
- Access to the application environment and relevant configuration or dependency files is required.
- Major Node.js version upgrades, application code modifications, dependency conflicts and extensive troubleshooting are excluded from the standard package.
- Production deployment, service restarts and downtime-related activities are handled according to the agreed scope and change window.
- Unsupported Node.js versions, EOL environments and custom builds requiring specialized remediation may require a separate assessment and quote.
Patched, but something on your website broke?
Security updates can remove or change the functions your website relies on. Our QA engineers find every break and rate it by severity, and our developers fix what the report lists. Priced per bug, with QA audits from $200.
Questions
What counts as an instance?
One server, VM or container host running the software being patched. WordPress and Rank Math PRO are priced per website, and Next.js and Node.js per application. Multiple PHP versions on the same server are covered by the same fee.
Is my server or application eligible?
Most services apply to supported, non-EOL systems managed through standard or authorized repositories. End-of-life systems, custom builds and major upgrades are outside the standard package and may be quoted separately.
I already have a Server Management and Maintenance agreement.
Updates or patching already covered under your SMM agreement are provided at no additional charge.
What if the update breaks my website?
Patching covers the security update and basic verification. If pages, plugins or integrations stop working afterwards, our post-patch QA and development service finds and fixes the issues.
Can't I just change a few settings?
Settings reduce exposure to some known attack paths but do not make a server safe. For the critical PHP flaws, the PHP project states that an update is the only complete fix.
I have more than 5 servers.
Contact our support team for volume discounts on fleet-wide patching.
Don't wait for an exploit to find you.
Close the critical vulnerabilities on your servers, websites and applications. $29.99 per item.