Security updates and vulnerability fixes
A website is made of dozens of components: the operating system, web server, PHP or Node.js, database, CMS core, modules, plugins and libraries. A vulnerability in any of them opens the door to the whole project, and high-profile cases like PHP2Shell show that every hour counts. We check every version against databases of known vulnerabilities, build a prioritised list, update the components on staging and roll out to production with a rollback plan. After the update we check the site for signs of compromise.
What's included
- Inventory: versions of the OS, web server, PHP or Node.js, database, CMS, modules and libraries
- Checks against CVE databases and composer audit and npm audit reports, with a prioritised list of vulnerabilities
- Critical vulnerabilities first: an update or interim measures while the full upgrade is prepared
- Updates to the CMS core, modules, plugins and dependencies, replacing abandoned extensions
- Staging, regression testing and production rollout with a rollback plan
- Checking logs and files for signs of compromise, rotating passwords and access keys
Technologies
How we work
- 01
Brief and estimate
We look at the task, your current system and constraints, then name the timeline and budget and suggest how to work together.
- 02
Specification
We capture requirements and acceptance criteria in a specification — it is what we build against and how the result is accepted.
- 03
Iterative development
You see the result after every iteration; we test and fix before anything goes into a release.
- 04
Launch and support
We ship with no downtime, monitor the product after launch and stay on for support if you need it.
Cost and timeline
Hourly Rates: from $40 to $80 / hour — depending on specialist qualification.
We give an exact timeline and budget after a brief: we break down the task, fix the scope and suggest a format — a fixed plan or hourly work.
See plansFAQ
How is this different from a platform upgrade?
A platform upgrade is a planned move to a new version, for example from Magento 2.4.6 to 2.4.9. Here the goal is different: close known vulnerabilities across every component of the site as fast as possible, starting with the most dangerous. If that requires a move to a new version, we plan it separately.
How do I know whether my site is vulnerable?
By comparing the versions of all components with databases of known vulnerabilities. We do this at the start and show you a report: what is vulnerable, how dangerous it is and what to update first.
Can updates be regular rather than only in an emergency?
Yes. After a one-off update you can move to SLA support: we track security fixes as they are released and install them without downtime.
Security updates and vulnerability fixes
We update everything outdated and vulnerable: server, PHP and Node.js, CMS core, modules and dependencies, checked against CVE databases, with a rollback plan.