// Security alert · 21 October 2026
Two critical PHP vulnerabilities need patching now
CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) affect every supported PHP version, and PHP 8.1 and earlier will not be patched at all. Running older or legacy software? Get in touch and we'll help you patch and upgrade.
// Legacy Rescue & Modernisation
Legacy software, rescued and rebuilt.
Drewdan Limited is a UK software engineering consultancy specialising in saving and modernising legacy applications — porting ageing stacks to modern frameworks, closing security holes, and building solid, expandable architecture. AI-backed tooling keeps delivery fast without cutting corners, and the same rigour carries over to greenfield builds and integrations.
// What we do
Services
Legacy Rescue & Modernisation
Inherited a legacy application nobody wants to touch? We audit, stabilise, and port it to modern, well-tested architecture — without a risky big-bang rewrite.
Security Remediation
Vulnerability audits and fixes for ageing codebases — dependency upgrades, auth hardening, and closing the holes that put legacy systems at risk.
Laravel Architecture & Engineering
Deep Laravel expertise, from serverless deployments on Laravel Vapor to clean, expandable architecture built to outlast the next five years of feature requests.
AI-Accelerated Delivery
AI-backed tooling built into our workflow speeds up audits, migrations, and test coverage — without compromising on quality or code review.
Infrastructure Cost Audits
Structured reviews of hosting, servers, and cloud spend to find what's oversized, unused, or badly configured. One recent audit cut a client's monthly infrastructure bill by roughly £975.
Read the case study →Specialist Network
For work outside core engineering, we bring in trusted specialists — telephony, UX/design, and enterprise device management — so the full scope of a project is covered under one roof.
Web Application Development
Full-stack web applications built with modern frameworks — Vue, Nuxt, React, Node.js, and more. From MVP to production.
Cloud & Edge Architecture
Serverless solutions on Cloudflare Workers, AWS Lambda, and Vercel Edge. Globally distributed, ultra-low latency.
// Featured Product
SimpleSocket.io
Managed WebSocket infrastructure — WebSockets that just work. Pusher-compatible drop-in hosting with support for Laravel Echo, Vue, React, and SDKs across PHP, JavaScript, Python, Ruby, and Go. Free tier available.
Visit SimpleSocket.io// Recent writing
Articles
Patching the October 2026 PHP Vulnerabilities: A Laravel Developer's Guide
Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2) were disclosed on 21 October 2026. Here's what's affected, which versions fix it, and how to patch Forge, Cloud, Vapor and Envoyer apps - including what to do if the Forge dashboard is struggling.
How to Set Up a VM on a Remote, Headless Hyper-V Host
A practical, start-to-finish guide to getting a virtual machine running on a dedicated Hyper-V server you only reach through a browser-based console — console access, remote management, uploading an ISO or an existing VHDX, and networking a VM that has no DHCP to talk to.
What Is a BMC, and Why Does Every Dedicated Server Have One?
A BMC is a tiny, independent computer living inside your server, with its own power and network connection, capable of controlling the machine even when it's switched off. Here's what it actually is, what IPMI and Redfish have to do with it, and why it's also one of the more overlooked security risks in a server room.
Got a legacy system holding you back?
Tell us about your application and we'll be in touch within one business day.
Get a Free Quote