Engenharia
Service
Ler em português

Security & emergency maintenance

Fast remediation of critical vulnerabilities in servers, websites and systems, with a prior check, backup and testing.

Current context

In October 2026, two critical PHP flaws known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619) were disclosed, affecting PHP 5.4 through 8.5.11. Fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. On October 21, 2026, Node.js published security releases, fixed in 22.23.4, 24.22.1 and 26.12.1. Servers running WordPress, PHP or outdated Node applications should be checked and updated.

Request a free check

Observed problem

A critical vulnerability is disclosed and nobody knows exactly which servers, containers and websites run the affected version, or how to update without taking operations down.

Expected outcome

An inventory of what is exposed, fixes applied with backup and a rollback plan, and a record of what was tested.

What the scope includes.

  • read-only check of versions, ports and services
  • backup, fix and rollback plan
  • production testing and a report of what changed

Use cases.

  • Fast patching of critical vulnerabilities

    We find where the affected version runs and apply the official fix, prioritizing what is exposed to the internet.

  • PHP and Node updates without downtime

    Version upgrades on hosts and containers within an agreed window, controlled recreation and confirmation that the service is back.

  • Audit of exposed ports and services

    A survey of what answers on the internet and a recommendation of what to close, restrict or put behind a proxy.

  • WordPress hardening

    Core, theme and plugin updates, review of users and permissions, and a smaller attack surface.

  • Backups and rollback plan

    Database, file and image backups before any change, with a documented procedure to undo it.

  • LGPD basics

    Review of where personal data lives, who accesses it, secrets exposed in code and a minimal incident log.

How it works

  1. 01Read-only check: versions, ports and services, without changing anything.
  2. 02Full backup of everything that will change.
  3. 03Agreed fix, applied within the agreed window.
  4. 04Service testing and a report of what changed.

How we begin

A discovery conversation defines the bottleneck, dependencies, evidence of completion and what stays out. Pricing follows that scope.

Engagements can be structured in USD, EUR or BRL. Timelines and pricing depend on validated scope.

Request a free check
Security & emergency maintenance — DOUVRAS Labs