Website maintenance

A small, practical toolkit for website owners, developers and AI agents: a safe update checklist, a tiny PHP version check, and an agent skill. It is the approach Nuvyr follows for website updates, shared so anyone can run safer updates.

October 2026: critical PHP security release

PHP fixed two critical remote code execution flaws (CVE-2026-109618, CVE-2026-109619) on October 21, 2026. The patched releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Updating WordPress alone does not fix this: the PHP runtime underneath needs the patch.

Check a server in one minute (over SSH, never on a public web path):

git clone https://github.com/pixexid/website-maintenance.git
php website-maintenance/php-check/php-check.php

Read ADVISORY-2026-10-PHP.md for what to check and the official sources.

Other October 2026 advisories: Node.js and WordPress core and Adobe Commerce / Magento.

Tools in this repo

1. Update checklist

CHECKLIST.md — a step-by-step list for before, during, and after a website update: authorization and inventory, backup and tested restore, a protected staging copy, the smallest necessary change, testing the business journeys, verifying the running build, the handoff record, and the rollback boundary.

Start here if you are planning an update.

2. PHP version check (php-check)

A single dependency-free PHP CLI script. It reports the PHP version, SAPI, OS, and loaded extension count, checks the branch support status, and flags versions below the October 2026 advisory patch floor. It makes no network calls and reads no secrets.

php php-check/php-check.php
php php-check/php-check.php --json

Exit codes: 0 means OK, 1 means action recommended, 2 means error. See php-check/README.md for details, including how to run its self-test (php-check/test.sh).

Note: run this on the server over SSH or in CI. Never expose phpinfo() or this script on a public web path.

3. Agent skill (skills/php-security-check)

A SKILL.md that teaches AI coding agents (Claude Code, Codex, pi, Cursor and others that support skills) to check a PHP site safely: find the PHP that actually serves the site, run php-check --json, respect vendor backports, check CMS and Composer packages separately, and never expose phpinfo(). Install it by copying the folder into your agent's skills directory, for example:

cp -r skills/php-security-check ~/.claude/skills/   # Claude Code
cp -r skills/php-security-check ~/.agents/skills/   # agents using ~/.agents

The skill carries the key facts itself and points agents to this repo for the script and checklist.

When to get help

Use this repo for routine, low-risk updates you fully understand and can roll back. Get help — from us or another qualified professional — when any of these apply:

• there is no tested backup, or you cannot afford downtime;
• the site handles payments, bookings, personal data, or legal compliance;
• anything looks compromised (unknown admin users, unexpected files, spam pages, ransom notes) — that is incident response, not maintenance;
• the update spans major versions, or staging and production behave differently and you cannot explain why.

Maintained by Nuvyr

Maintained by Nuvyr. We keep small business websites updated, backed up, and recoverable: https://nuvyr.com/website-updates — background reading on the October 2026 PHP security releases: https://nuvyr.com/guides/php-security-update-october-2026

Licence

MIT — see LICENSE. No warranties; see the checklist disclaimer.