Security patching
Patch your Next.js, Node or PHP app for the latest CVE, fast
Free "am I affected?" check, then a fixed-price patch, tested and deployed in 24–48 hours. 8 years of production engineering.
What I fix
Next.js RCE (CVE-2026-96889)
Image optimizer and use cache flaws, fixed in Next.js 16.4.1 and 15.5.28.
Node2Shell, the Node.js Brotli bug (CVE-2026-111497)
Express 5, fetch() and axios pass outside Brotli data to the decoder. Fixed in Node.js 26.12.1, 24.22.1 and 22.23.4.
eMudhra CA compromise
Servers and containers with old trust stores still accept certificates browsers already block.
PHP2Shell (CVE-2026-109618, CVE-2026-109619)
Under active attack. Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; PHP 8.1 and older need a backport or an upgrade.
How it works
- 01
Free check
Send your runtime and framework versions and how you deploy. I tell you whether the CVE affects you and what has to change.
- 02
Fixed quote in writing
If you want it done, you get a fixed price and timeline before any work starts.
- 03
Patch, test, deploy
Upgrade on a branch or staging first, run your build and key flows, then deploy with a rollback ready.
- 04
Short report
What was affected, what changed, the versions now running and anything left to watch.
Pricing
Fixed price, agreed in writing before work starts. You pay after the fix is done and verified; only the Audit + Patch tier is 50% upfront.
Quick Patch
$79–149
24–48 hours
- One app or service
- One critical CVE
- Tested and deployed, with a short report
Multi-Service
$199–349
Scheduled with you
- Up to 3 services, or one breaking upgrade
- Every critical CVE in scope
- Coordinated rollout and report
Audit + Patch
From $499
Scoped together
- Full stack review of runtimes, dependencies and images
- Everything critical patched
- Written audit report; 50% upfront
Why me
8 years
of hands-on work on production web apps, APIs and servers.
4.9★
100+ orders on Fiverr.
Open-source checkers
The scripts from the guides, tested and public: next-security-check, node-brotli-check, php2shell-check.
Common questions
Is my Next.js app vulnerable to the latest CVE?+
CVE-2026-96889 affects every Next.js release from 10.0.0 up to 15.5.27, and 16.0 up to 16.4.0, when the image optimizer serves SVG files. A second critical flaw affects use cache in 16.0 to 16.4.0. The free check tells you whether your version and setup are in scope.
Which Next.js version fixes it?+
Next.js 16.4.1 for the 16.x line and 15.5.28 for 15.x, released on 14 October 2026. On 15.x, also make sure sharp is 0.35.5 or later, because the image flaw is fixed there too. Apps on 14.x or older need to move to 15.5.28 or 16.4.1.
How long does a patch take?+
A single app is usually patched, tested and deployed within 24 to 48 hours of the quote being accepted. Several services or a breaking upgrade are scheduled with you, so nothing is rushed into production.
Will upgrading break my app?+
Security releases are usually small, but I never upgrade straight in production. The fix goes onto a branch or staging first, the build and your key flows are tested, and the deploy has a rollback ready. If the fix needs a breaking upgrade, you get that in the quote before work starts.
Do you sign an NDA?+
Yes. I'm happy to sign your NDA before you share code, logs or access.
Not sure if you're affected?
Send your versions and how you deploy. The check is free, and you'll know what to change either way. Please don't send passwords, keys or .env values: versions and lockfiles are enough.