Vulnerability patch broke your website? We find and fix it.
Moving to a patched PHP, Next.js, Node.js, Nginx, WordPress, Splunk or Linux release closes critical holes. It can also remove or change the functions your site depends on. Our QA engineers find every break and rate it by severity. Our developers then fix exactly what the report lists.
Priced by bug count and severity. No contract.
QA audit from $200. Fixes are retested before you pay for them.
A security patch fixes the hole. It can also remove the code your site relied on.
These are the recent critical releases we see customers upgrading to. Once your infrastructure team applies them, a QA pass shows what no longer works.
Unauthenticated remote code execution.
Fixed in: 8.5.12, 8.4.27, 8.3.36, 8.2.35 (21 Oct 2026)
Where sites break: deprecated and removed functions, dropped extensions, stricter typing and legacy plugin or theme code, especially when moving off PHP 8.1 and older.
Two critical unauthenticated RCEs, including CVE-2026-96889 in SVG image processing.
Fixed in: 16.4.1 and 15.5.28 (14 Oct 2026)
Where sites break: changed APIs and config between versions, caching behavior, image handling and bumped React and sharp dependencies.
An out-of-bounds write in the bundled Brotli decoder can allow remote code execution. Other flaws weaken TLS hostname checks and DNS name handling.
Fixed in: 26.12.1, 24.22.1 and 22.23.4 (21 Oct 2026). End-of-life lines get no fix.
Where sites break: runtime upgrades that break native modules and unsupported dependencies, stricter TLS and DNS handling that can reject connections that used to work, and container images that must be rebuilt.
Heap buffer overflow in the rewrite module.
Fixed in: 1.31.1 and 1.30.2 (Open Source)
Where sites break: rewrite and redirect rules, module compatibility, TLS and header configuration after a version jump.
A chain leading to unauthenticated RCE. Forced auto-updates were enabled.
Fixed in: 7.0.2 (17 Jul 2026), 7.0.3 (6 Aug 2026)
Where sites break: themes and plugins calling old core APIs, custom WP_Query code and REST integrations.
CVE-2026-20253 is exploited in the wild.
Fixed in: latest Splunk Enterprise releases per the vendor advisories
Where sites break: custom apps and add-ons, dashboards, saved searches and REST integrations.
A use-after-free in the traffic control subsystem, plus other critical kernel fixes.
Fixed in: kernels 6.6.145, 6.1.178 and 5.15.212 or later
Where sites break: OS upgrades bring newer system libraries and PHP, Python or Node runtimes. Cron jobs, services and containers can misbehave.
QA finds the breaks. Developers fix what the report lists.
Scope and access
We agree what is in scope, get a staging copy and take a backup before anything is touched.
QA audit
Our QA team tests key flows, scans code for deprecated calls, and reads error logs and the browser console.
Severity-rated report
Every bug gets a severity, a URL, steps to reproduce and a root cause. The bug count sets your fix quote.
You approve, we fix
Our developers fix the approved bugs on staging, starting with Critical and High.
Retest and sign-off
QA retests every fix, then we deploy and send a written summary of what changed.
You pay for the bugs we find, rated by how much they hurt.
Each bug carries a fixed price based on its severity. The effort column shows how long a typical fix takes. The price includes the fix, the retest and the deploy. Bugs that share one root cause are billed once.
Fix cost = number of bugs at each severity × the price per bug. The QA audit is billed separately, from $200.
Bundle the audit and the fixes. Pay less than buying them separately.
The Essential package covers a QA audit plus a block of bug fixes. Prices assume the typical severity mix shown. Your final fix quote comes from the QA report.
One small site or app
Worth $522.90 if bought separately. You save $72.91.
- QA audit (6-8 hours of testing)
- Severity-rated bug report
- Up to 10 bug fixes (typical mix: 1 Critical, 2 High, 3 Medium, 4 Low)
- Retest of every fix
- Written fix summary
Get the severity-rated report and decide later. Priced by audit size, from $200.
Already have a bug list? Send it and we quote by count and severity. Bugs beyond a package are billed at the same rates.
Contact us for volume pricing across a fleet of sites.
Already know your bug count? See the fix cost.
Set the number of bugs at each severity. The estimate uses the rate card above. Add the QA audit, from $200, for the full picture.
Get my exact quoteEstimate only. Your quote is based on the severity ratings in your QA report.
Two teams, one handover.
QA service
- Regression testing of key flows: login, forms, search, checkout and admin
- Code scan for deprecated and removed functions across your code, themes and plugins
- Node.js runtime, dependency and native-module compatibility checks
- Server error log and browser console review
- API, webhook and third-party integration checks
- Redirect, rewrite and header checks after web server upgrades
- Responsive and cross-browser checks
- Severity-rated report with URLs, steps to reproduce and root cause
Development service
- Fixes for deprecated and removed functions and changed APIs
- Compatibility patches for themes, plugins and custom modules
- Next.js version migration fixes, covering config, caching and image handling
- Node.js runtime and dependency upgrade fixes, including TLS and DNS behavior changes
- Web server and application configuration fixes
- Fixes built and tested on staging, then deployed with a rollback plan
- Every fix retested by QA before sign-off
- Written summary of what changed, for your records
Close the vulnerability first. Then we check your website.
If your servers or applications still run a vulnerable version, your website is exposed right now. Our server engineers update, secure and verify each instance for you. Once that is done, come back here for the QA audit and fixes.
Questions
Do I have to buy both the QA audit and the fixes?
No. You can buy the audit alone, fixes alone if you already have a bug list, or a package that bundles both for less than buying them separately.
Does this include upgrading the server or software?
No. This service starts after the upgrade, or on a staging copy that already runs the new version. If you also need the patch applied, see our critical vulnerability patching or emergency server support.
Who decides a bug's severity?
Our QA lead rates each bug against the table above and shows the reasoning in the report. If you disagree with a rating, raise it before approving the fixes.
What if new bugs turn up while you are fixing?
We log and rate them, then ask for your approval before any extra work. Additional bugs are billed at the same rate card.
Will you work on my live site?
We prefer a staging copy. We back up first, test and fix there, and deploy to production only after you approve.
How long will it take?
It depends on the size of the site. We confirm timelines when we scope the audit, and again with the report once the bug count is known.
Don't let a security patch take your website down.
Find out what broke before your customers do. QA audits start at $200.