Patchwarden Request access

PHP2Shell · CVE-2026-109618 · CVE-2026-109619

A warden for every PHP site you look after.

Patchwarden finds the PHP websites exposed to PHP2Shell, fixes them with the owner's approval, and watches them every day after. Self-hosted. No passwords. Nothing changes until someone says yes.

See what owners get Get the code

How it works

From a free scan to a site that stays safe.

  1. 1

    Scan it from the outside.

    Enter a domain, or upload a CSV of every client site. Each one gets a one-page report an owner can read: your version, your risk, what to do next. A hidden version is reported as unknown, never guessed.

  2. 2

    Approve the fix.

    Every update starts as a dry run that lists exactly what will happen. Once the owner approves, Patchwarden backs up, updates, restarts and checks the homepage, login and checkout pages.

  3. 3

    Let it keep watch.

    Protected sites are re-checked every day, and every new PHP flaw is matched against them every hour. The owner hears about a new risk the day it appears, and gets a safety report every month.

  4. 4

    Move what can't be patched.

    PHP 8.1 and older have no fix. Patchwarden finds the code that will break, down to the file and line, tests the move on a staging copy, and goes live only after the owner signs off.

It never changes a site you haven't approved.

Every change starts as a dry run, is backed up first, and puts itself back if the homepage, login or checkout stops working, with a before/after report to prove it.

The agents

Five agents. One is free, four earn.

The free scan finds the customer. The Patch agent fixes them once, the Watchdog keeps them safe every month, and the Migration agent takes on the big projects.

Free

Scanner

An outside check of any site, or of a whole CSV of sites. It gives a one-page report with a signed link the owner can forward.

Needs
Nothing
Earns
Your leads

Per site

Patch

Backup, update, restart, test, and automatic rollback. A dry run comes first, and the owner's approval is always on record.

Needs
A cPanel or Plesk API token
Earns
A one-time fee per site

Monthly

Watchdog

A version check every day and new-CVE matching every hour. Plain-language alerts arrive by email, and a safety report every month.

Needs
Nothing (or the read-only plugin)
Earns
A monthly fee per site

Project

Migration

A breakage report with file and line, an ordered fix plan with an effort estimate, staging tests, then sign-off and go-live.

Needs
A panel token and a staging copy
Earns
A project price

Per site · monthly

WordPress Guard

Scan, patch and watch in one product: a safety score, a fix list without jargon, and one Fix it button.

Needs
The Patchwarden plugin
Earns
A monthly fee, at volume

Made for people who look after many sites

Agencies, hosting resellers, freelancers and managed-service providers. Scan your whole client list in one upload, then offer the fix and the monthly watch.

Request access →

Trust

The owner holds the keys.

These rules are enforced in the code and covered by automated tests, not just written in a policy.

No password, ever.

Owners give an API token they create in their hosting panel, or install the plugin. Tokens are encrypted, and never shown again.

Approval on the record.

Who approved, and when, is saved before anything runs. Every action lands in an audit log.

Backups you can prove.

Each backup is checked by checksum and a restore dry-run. If the backup fails, nothing changes.

Revocable in one click.

Delete the token or uninstall the plugin, and access ends on both sides.

Nothing leaks.

Canary tests prove no credential reaches a response, report, alert, email or log.

No AI guessing.

The agents are deterministic checkers. A hidden version stays "unknown" until it can be checked from the inside.

Screens

Reports an owner can actually read.

Real pages from the Patchwarden demo sites. Pick one to look around.

patchwarden · example

Open full page ↗

Run it

Running in three steps.

Patchwarden is one web app plus PostgreSQL, packaged for Docker. It runs natively on Apple Silicon and x86.

  1. Get it, and make your secrets.

    Get the code, then write a private .env with generated values for the token key, the encryption key and the database password. It never goes into git.

    git clone https://github.com/harshagv/patchwarden.git
cd patchwarden
make env

  2. Point it at your domain.

    Set PUBLIC_BASE_URL in .env to your HTTPS address, and add SMTP if you want alerts by email. Then check the settings: in production, Patchwarden refuses to start and names any missing secret.

    make check-config

  3. Start it.

    It listens on 127.0.0.1:8000, so put it behind your HTTPS reverse proxy. Site owners download the WordPress plugin from their dashboard, already set up for your address.

    make up

Try it first, on your laptop

make dev starts Patchwarden with built-in demo websites and pretend hosting panels, so you need no accounts and no secrets. Patch a site, watch one roll itself back, and plan a migration from PHP 7.4, all in about five minutes. The guide walks through it.

Status

What is ready today.

Patchwarden is a preview release. Here is exactly what works, so you can be straight with your customers.

AreaStatus
Scanner, one-page reports, CSV bulk scans, WordPress plugin and theme checkReady
Approval, backup, checks, automatic rollback and audit logReady tested against simulated hosting panels
Watchdog: daily checks, CVE and release matching, alerts, monthly reportsReady
Migration: breakage scan, plan, staging, sign-off, promotionReady tested against simulated hosting
WordPress pluginReady not yet tested inside a full WordPress install
Real cPanel and Plesk connectionsNot connected yet the interface is ready, and the connectors refuse to act rather than pretend
Docker deploymentWritten, not yet run end to end
Payments and agency white-label billingNot in this release

Put a warden on every site you look after.

Patchwarden is open source and in preview. Run it yourself, or tell me about the sites you look after.

Get the code Request access