# Patch the Hull

> A free version check and a metered patch-night runbook for owners of small websites after the October 2026 PHP fixes (CVE-2026-109618 and CVE-2026-109619, affecting PHP 5.4 to 8.5).

URL: https://patch-the-hull.skillsafe.ai/
API: https://patch-the-hull.skillsafe.ai/api.html

## What it does

- You type the PHP version your hosting panel shows, a short site label, and five answers: hosting, who changes the server, backup, whether a short outage is fine, and whether visitors log in or pay.
- The page decides one verdict with fixed rules against the fixed builds published on 21 October 2026: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Lines 7.4, 8.0 and 8.1 got source patches only; 5.4 to 7.3 got no fix.
- Verdicts, first match wins: find the version (no full number the page can read), move to a supported line (older than 5.4, or 5.4 to 7.3), fixed build (8.2 to 8.5 at or past the fixed build), update now (below it), backport or move up (7.4, 8.0, 8.1).
- The site is drawn on a ship's hull with one plank per release line: plates for lines with a fixed build, plugs for source-patch-only lines, open seams for lines with no fix.
- One metered run (task `patch-plan`, model gpt-terra) writes 3 to 6 steps naming who does each one (you, a web person or the hosting company), what to do if it stalls, how to recover, and a note for the person who changes the server. The page then checks the reply against its own facts.

## Limits

- Distribution and panel builds can carry backported fixes under older-looking numbers; the page flags them and asks you to check with whoever maintains the server.
- Version facts as published on 21 October 2026; check php.net for later releases. An independent helper, not affiliated with the PHP project; not professional security advice.
- Never put passwords, logins or contact details in the form.

## Sources

- Skill: @wshobson/incident-runbook-templates on SkillSafe (structured runbooks with step-by-step procedures, escalation paths and recovery actions).
- Version facts: Wikipedia (CC BY-SA 4.0).