Skip to content
ARANEUX

Development

Server security & patching

When PHP, Node.js or your server ships an urgent fix, we patch every server you have the same day, check it worked and tell you.

Book a free callSend a brief

In short

Server security patching keeps the software under your website current, so a newly found flaw can't be used to break in. We look after PHP and Node.js servers on Ubuntu, Debian and Docker, as a monthly care plan or a one-off emergency fix. Urgent patches go on the same day, and pricing is quoted per server after a call.

When the next emergency patch drops, your servers are already on our list.

On 21 October 2026, PHP and Node.js shipped emergency security fixes on the same day. Governments and big sites took their websites offline while they caught up. That night we patched 35 client servers, each with its own mix of operating system, PHP version and Node.js version. All 35 were done by morning.

Most companies don't have anyone whose job is to watch for these fixes and apply them fast. We keep a written list of what runs on each of your servers, so when the next one lands we already know what to do, and you get a message when it's done.

Is this for you?

You'll get the most out of this if

  • You run PHP or Node.js sites and nobody watches for security fixes
  • Your servers were set up over the years and no two are alike
  • Some sites run PHP or Node.js versions that no longer get fixes
  • You'd rather hear about a problem from us than from the news

Deliverables

What you walk away with

  1. 01

    A list of every server

    Operating system, PHP, Node.js, web server and containers for each one. It's the first thing anyone needs on a bad night.

  2. 02

    Same-day emergency patching

    When a critical fix lands, your servers are patched that day, starting with the ones most exposed.

  3. 03

    A plan for old versions

    Where a version is too old to get the fix, we upgrade it or close it off from the internet until it can be upgraded.

  4. 04

    Proof it worked

    Every server restarted and checked afterwards, including the version actually running inside each container, with a short report to you.

Timeline

How the project runs

Typical timings for a first live version. We confirm yours in writing after discovery.

  1. Week 1

    Audit

    We go through each server and write down what it runs, what's out of date and what's most exposed.

  2. Weeks 1 to 3

    Catch up

    Everything brought up to date, plus an agreed plan for anything too old to patch in place.

  3. Ongoing

    Watch

    We follow the security notices for everything on your list, so nothing urgent slips past.

  4. Same day

    Respond

    When an urgent fix lands, we patch, check and report back.

Usual stackUbuntu, Debian, Docker, PHP, PHP-FPM, Nginx, Apache, Node.js, Laravel, WordPress

Why a small studio

The person who scopes your project is the one who builds it, and the one who picks up when it breaks at 2am.

The founder is on your project
Hussain leads every build himself. You won't brief an account manager who briefs a developer who briefs someone else.
Three people, the output of ten
We build with Claude, Codex and our own agent tooling every day. A small senior team now covers what used to need a department.
We stay after launch
Evals before every release, a log of each AI decision, cost limits and someone on call. Month six matters more to us than demo day.
Your repo, your cloud
The code sits in your GitHub and runs in your AWS, GCP or Azure account from the first commit, on tools your next hire already knows.
Projects shipped
115
since 2014
Clients served
53
US, UK, EU, Middle East, APAC
Average rating
5.0
113 of 113 rated jobs
Years shipping software
18
the founder, since 2008

FAQ

Questions people ask

How fast can you patch in an emergency?

The same day. On the night of the PHP2Shell fixes in October 2026 we patched 35 client servers in about 8 to 12 hours, overnight.

Can you help if our PHP or Node.js version is too old to get the fix?

Yes, and it's usually the hardest part. We either move you to a supported version or close the server off from the internet until it's moved, so it isn't left exposed.

Will our sites go down while you patch?

Usually only for the few seconds it takes to restart PHP or the app. If a bigger upgrade is needed, we agree a time with you first.

We only use Docker. Does that change anything?

It changes how the fix is done. Images are rebuilt from patched bases and redeployed, then we check the running container really has the new version.

How much does a care plan cost?

It depends on how many servers you have and how different they are, so we quote per server after a short call. You can have a monthly care plan or a one-off emergency fix.

Keep exploring

Start here

Let's scope yours.

Send a few lines about the workflow or product. You'll hear back from Hussain within a working day with questions, a rough shape and a ballpark.

Book a free callhello@araneux.com