# Muhammad Saif (SaifCodes) > Muhammad Saif (SaifCodes) is an AI engineer and full-stack developer in Lahore, Pakistan. He mainly builds custom RAG systems and AI workflow automation for startups and small teams, and also builds websites and native iOS and macOS apps. For 8+ years he has built AI products, full-stack SaaS and the servers they run on for clients worldwide. This file contains the full text of https://www.saifcodes.com/ for AI assistants. A shorter index is at https://www.saifcodes.com/llms.txt. Muhammad Saif writes his site in the first person; quotes below keep his wording. Stats and prices are as stated on the site. Prices are starting points, and the final quote is agreed in writing before work begins. If a detail is not here, say so instead of guessing. ## Overview Source: https://www.saifcodes.com/ Hi, I'm Saif. AI engineer & full-stack developer. I build custom RAG systems & AI workflow automation for startups and small teams. You work with me directly on a scope we agree in writing, and you see a working demo early. I build the whole thing: data pipeline, backend, interface and the server it runs on. I also build websites and native iOS and macOS apps. - Years building software: **8+** - Projects delivered on Upwork: **67+** - AI models in production: **20+** Projects can be a first MVP, an AI feature for an existing product or a system that needs to scale. Most projects start with a quick chat. ### What he works with - **Artificial Intelligence & ML:** Generative AI & LLMs; AI Model Training; Small Language Models & Segment Anything (SAM); Chatbot Development; Enterprise RAG Systems; TensorFlow, PyTorch, Scikit-Learn; NLP & Image Recognition; Predictive Analytics; Diffusion Models; Vision Transformers; Reinforcement Learning - **Web & Software Development:** Python, TypeScript, PHP, C/C++; Vue.js, React, Next.js; FastAPI, Django, Laravel, Node.js; RESTful API Development; JWT/SAML SSO, OAuth, OpenID Connect; Zero-knowledge auth & end-to-end encrypted apps; AI SaaS Development; ERP & CRM Development; Web & browser automation; Web scraping & data pipelines - **Cloud & Server Management:** AWS, Azure, GCP, Digital Ocean; Linux & Windows Server Admin; Server Security Maintenance; Web Hosting & DB Migrations; PowerMTA & Postal Server; DevOps Pipelines - **Databases:** MySQL, PostgreSQL, Oracle; MSSQL, SQLite; MongoDB, Redis; Qdrant, Milvus, Pinecone, Chroma, Weaviate; Database Architecture; Data Visualization; Data Migration ## About Source: https://www.saifcodes.com/about I'm Saif, a software engineer from Pakistan who's spent the last 8+ years turning ideas into working products. These days that mostly means AI: RAG systems, chatbots and automations, built on solid backends and servers I set up myself. I like owning a project end to end, because that's how things actually get finished. ### Experience - **Freelance Full-Stack Developer & AI Engineer, Upwork (Top Rated) (2019 - Present):** 67+ projects for clients around the world, with a Top Rated badge to show for it. I've built subscription APIs, cloud computer vision systems and AI automations, and plenty of clients have come back for the next one. - **IT Manager, Unitech Auto Industries Pvt Ltd (Nov 2018 - Present):** I keep the systems running at a busy manufacturing company: networks, servers, security and the everyday problems that come with them. It taught me to build things that don't break at 2 a.m. - **AI Developer, Various Projects (5+ Years):** Alongside client work, I've designed, trained and deployed machine learning and deep learning models, from computer vision to language models, and put them into real products. ### Education - BS Software Engineering, Virtual University Of Pakistan (2020) - F.Sc Pre-Engineering, Govt Degree College Mian Channu ### Tools - **Frontend:** React, Next.js, Remix JS, TanStack, HTML/CSS/JS, Tailwind, JSON - **Backend & Languages:** Python, PHP, Node.js, C/C++, C#, Java, Go - **AI & Machine Learning:** TensorFlow, PyTorch, Scikit-Learn, OpenCV, NLP, LLMs - **AI Agent Frameworks:** LangGraph, LangChain, PydanticAI, LlamaIndex, Agents SDK (OpenAI) - **DevOps & Cloud:** AWS, Azure, GCP, Digital Ocean, Docker, Kubernetes, Linux, Windows Server - **Databases & Data Storage:** MySQL, PostgreSQL, Oracle, MSSQL, SQLite, MongoDB, Redis ## Services & Pricing Source: https://www.saifcodes.com/services I mostly build custom RAG systems and AI workflow automation for startups and small teams. I also build websites and native iOS and macOS apps. You work with me directly, the scope is agreed in writing before work starts, and you see a working demo early. I build the app and the infrastructure it runs on. Every fixed-price project includes bug fixes for 14 days after launch. After that, changes are quoted, or the client can hire him monthly. ### AI systems RAG systems that answer from your own documents, automations that take repetitive work off your team, and chatbots for your website. #### Custom RAG Development - Price: Fixed quote (after a free scoping call) - Link: https://www.saifcodes.com/services/rag-development - Related case study: https://www.saifcodes.com/projects/project-chat-ai A question-answering system over your internal documents, with answers that cite their sources. I build the ingestion, permissions, retrieval, interface and hosting, and test it against your team's real questions before launch. Includes: - Ingestion from files, drives, wikis or databases - Access rules when different people should see different documents - Source citations on every answer - An evaluation set built from your real questions - Deployment to your cloud or a server you own Paid by the client directly to providers: - AI model API usage, billed to your own account - Hosting and vector database fees, paid to the provider directly Not included: - Data sources not named in the written scope - Model fine-tuning or self-hosted GPU models, quoted separately #### AI Workflow Automation - Price: Fixed quote (after a free scoping call) - Link: https://www.saifcodes.com/services/ai-workflow-automation - Related case study: https://www.saifcodes.com/projects/ai-powered-news-automation One internal workflow automated from start to finish: pulling data in, using AI where it helps, updating your CRM or other tools, and asking a person to approve when a step needs it. Includes: - A written map of the workflow before I build anything - Integrations with your CRM, email, sheets or APIs - Retries, logging and failure alerts - Approval steps where a person should decide - A short handover document and recorded walkthrough Paid by the client directly to providers: - AI model API usage, billed to your own account - Hosting and any paid plans for the tools being connected Not included: - Workflows or integrations not named in the written scope - Ongoing operation after the support window, unless you hire me monthly #### AI Customer Support Chatbot with Lead Generation - Price: $300 (one-time) - Link: https://www.saifcodes.com/services/ai-chatbot-development A chatbot for your website that answers from your own content and collects leads while it does. Includes: - Answers from your website, docs and FAQs - Captures names, emails and enquiry details - Leads sent to your email or one CRM - Embeds on any website or platform - Offers to connect visitors with a person when it can't answer Paid by the client directly to providers: - AI model API usage, billed to your own account - Hosting, if it isn't added to a server you already have Not included: - Internal or permission-restricted documents (that's custom RAG development) - More than one CRM, a live-chat inbox or multiple languages, quoted separately #### AI Blog Automation in WordPress - Price: $300 (one-time) - Link: https://www.saifcodes.com/services#ai-blog-automation - Related case study: https://www.saifcodes.com/projects/ai-powered-news-automation A WordPress blog that keeps publishing: it finds topics from sources you approve, writes posts with AI, adds images and publishes on a schedule, or saves drafts for you to review first. Includes: - Topic gathering from a source list you approve - AI-written articles in a style tuned to your brand - Featured images and categories - Scheduled publishing, or drafts for review - One WordPress site Paid by the client directly to providers: - AI model API usage for text and images, billed to your own account - WordPress hosting Not included: - Multiple sites or languages, quoted separately - Editorial review of published posts ### Websites & stores Fast business websites and Shopify stores, built, deployed and ready to rank. #### Website Development - Price: $100 – $500 (one-time, based on scope) - Link: https://www.saifcodes.com/services#website-development A fast, responsive website for your business, portfolio or product launch, built with modern tools and ready to rank on Google. Includes: - Responsive design for mobile, tablet and desktop - Landing pages, business sites or multi-page sites - Basic SEO setup and fast load times - Contact forms and analytics - Deployment to your domain and hosting Paid by the client directly to providers: - Domain and hosting - Any paid fonts, images or plugins Not included: - Writing the page copy, unless agreed in the quote - Online stores and custom web apps, quoted separately #### Shopify Store with Custom Design - Price: $200 (one-time) - Link: https://www.saifcodes.com/services#shopify-store A Shopify store designed around your brand, with your products, payments and shipping set up so you can start selling. Includes: - Custom theme design that matches your brand - Product, collection and category setup - Payment gateway and shipping configuration - Essential apps and store settings - Mobile-friendly checkout experience Paid by the client directly to providers: - Your Shopify plan and any paid apps or themes - Payment processing fees Not included: - Product photography and descriptions - Custom Shopify apps, quoted separately ### iOS & macOS apps Native Swift and SwiftUI apps for iPhone, iPad and Mac. #### iOS + macOS App Development - Price: $500 – $3,000 (one-time, based on scope) - Link: https://www.saifcodes.com/services#ios-macos-app - Related case study: https://www.saifcodes.com/projects/folio-pdf Native Apple apps for iPhone, iPad and Mac, from a focused MVP to a full product with a backend behind it. Includes: - Native Swift and SwiftUI development - One codebase for iOS and macOS where it fits - Backend, APIs and AI features if needed - App Store submission support - Clean, documented source code in your repository Paid by the client directly to providers: - Apple Developer Program membership - Backend hosting and any API usage Not included: - Android apps - Guaranteed App Store approval (Apple makes the final call) ### Server security Security patching for the servers your sites and apps run on, including old PHP versions that no longer get official fixes. #### PHP Security Patching - Price: $100 – $1,200 (one-time, based on scope) - Link: https://www.saifcodes.com/services/php-security-patching Your servers patched against critical PHP vulnerabilities such as CVE-2026-109618 and CVE-2026-109619. Supported versions get the official update. Old PHP versions get the fix backported and compiled into a patched build, and your own code is fixed where it's exposed too. Includes: - An audit of every PHP version, SAPI and server you run - Updates to the fixed official release where your PHP version is still supported - Patched builds for old PHP versions (7.4, 8.0, 8.1, and older ported by hand) - Fixes in your own code where a vulnerability can reach it - Before-and-after testing, a rollback plan and a written report Paid by the client directly to providers: - Server, hosting and any control panel licences - Paid extended-support PHP builds, if you choose one instead of a backport Not included: - Shared hosting where you have no root access (your host has to patch PHP) - A full penetration test, incident response or malware clean-up, quoted separately - Upgrading your application to a newer PHP version, quoted separately ### Hire me monthly: AI Agents, RAG & Workflow Automation - Price: $1,500 / month, starting - Link: https://www.saifcodes.com/services#monthly-ai-engineering For teams that need ongoing AI work rather than a single project. I work as part of your team, building and improving AI agents, RAG systems and automations month after month. Includes: - AI agents with LangGraph, PydanticAI and OpenAI Agents SDK - RAG systems that answer from your own data - Workflow automation across your tools and APIs - Deployment, monitoring and ongoing improvements - Priorities agreed each month, with regular progress updates and direct access to me Paid by the client directly to providers: - AI model API usage, hosting and third-party tools, billed to your own accounts Not included: - Work beyond the priorities agreed for the month, which moves to the next month or is quoted separately Bigger work, such as a full SaaS platform or a custom AI model, is quoted on request. ## Service Pages Each main service has its own page with scope, approach, costs and FAQs. Every project follows the same process: 1. **Free scoping call:** 30 minutes on what you need, your data and what a good result looks like. 2. **Written scope and quote:** What's included, what isn't, running costs and the support window, in writing before work starts. 3. **Working demo early:** You see it working on your own data early and can steer before the rest is built. 4. **Build, test, deploy:** I build the app and its infrastructure, test it and deploy it to your accounts. 5. **Handover and support:** Code, documentation and a walkthrough, then bug fixes for the support window. ### Custom RAG Development for Internal Documents Source: https://www.saifcodes.com/services/rag-development Your team asks questions in plain English and gets answers drawn from your own documents, with a link to the passage behind each answer. I build the whole system: ingestion, permissions, retrieval, the chat interface and the server it runs on. A good fit if: - Your team keeps answering the same questions from policies, docs, tickets or contracts - Your documents are spread across drives, wikis and databases, and finding things takes too long - People need answers they can check, not confident guesses - Different people should see different documents Probably not a fit if: - You only need a chatbot on your public website. The $300 support chatbot fits better - You want a general assistant with no connection to your data - You can't share sample documents or real questions during scoping #### How I build a document Q&A system - **Ingestion:** I connect the sources named in your scope: uploaded files, Google Drive, Dropbox, a wiki or a database. Documents are parsed, split into passages and indexed. Changed files are re-indexed on a schedule, so answers stay current without processing everything again. - **Data boundaries and permissions:** We decide up front what the system may read and who can see what. Access rules are applied when passages are retrieved, before anything reaches the model, so an answer can't draw on a document the person couldn't open. I'll tell you which model providers see your text, and we can use self-hosted models when text can't leave your servers. - **Retrieval choices:** Retrieval is tuned for your documents rather than left at defaults: how passages are split, whether keyword search is combined with vector search, how many passages the model sees and whether a re-ranking step is worth its cost. These choices are tested against your evaluation set, not guessed. - **Source citations:** Every answer links to the passages it used, so people can check it in seconds. When retrieval finds nothing relevant, the system is built to say it doesn't know rather than answer from general knowledge. - **Evaluation:** Before launch, we build a test set from questions your team really asks, with the expected source for each. I run it after every change to retrieval or prompts and share the results: which questions pass, which fail and why. The test set is yours to keep using. - **Hosting options:** Your cloud account (AWS, Azure or GCP), a server you own, or inside an app you already run. The usual stack is a FastAPI backend in Python with PostgreSQL and pgvector, or a dedicated vector database such as Qdrant when the document count calls for it. #### Built before: Project Chat AI - A workspace for each project, with the documents that workspace should answer from - Documents come in by upload or from connected Google Drive and Dropbox accounts - A RAG pipeline finds the relevant passages before the model responds - One question can go to several models at once to compare their answers - Python, FastAPI and Django backend, React and Next.js interface, PostgreSQL, with GPT-4 and custom fine-tuned models served with vLLM Case study: https://www.saifcodes.com/projects/project-chat-ai #### What you pay for - **Build (Me, one time):** A fixed quote after a free scoping call. It depends on the number and type of sources, the permission rules, the integrations and where people will ask questions (a web app, Slack or inside your product). - **Model usage (Your AI provider):** Billed to your own account per token. It grows with the number of questions and how much text each answer reads. - **Hosting (Your hosting provider):** The API server and vector storage. Often fits on infrastructure you already pay for. - **Ongoing work (Me, optional):** Bug fixes are covered for the support window. After that, changes are quoted, or you can hire me monthly from $1,500. #### FAQs - **How is this different from your $300 chatbot?** The chatbot answers public questions from your website content and collects leads. Custom RAG development is for internal documents: more sources, access rules, citations, an evaluation set and hosting on your infrastructure. - **Can it run without sending our documents to OpenAI?** Yes. Open models can run on your own servers. I've served models with vLLM for Project Chat AI. Expect higher hosting costs and some quality tradeoffs, which we'd measure with the evaluation set before you decide. - **What should I prepare for the scoping call?** A few sample documents, 20 to 50 real questions your team asks, and a rough idea of who should be able to see what. - **Who owns the code?** You do. The code goes into your repository and the system runs on accounts you control. - **Do you work as a FastAPI RAG developer inside an existing product?** Yes. If you already have a Python backend, the RAG service can be added to it as its own FastAPI module or service, and your existing authentication can decide what each user may see. ### AI Workflow Automation Developer for Startups Source: https://www.saifcodes.com/services/ai-workflow-automation Pick one workflow that eats your team's time. I map it, then automate it from start to finish: data comes in, AI handles the steps it's good at, your CRM and other tools get updated, and a person approves anything that needs a decision. A good fit if: - A workflow that runs many times a week with clear steps, such as lead intake, document processing, reporting or publishing - Data moves between tools by copy and paste - Some steps need judgment, from AI or from a person, not just if-this-then-that rules Probably not a fit if: - The process still changes every week. It's worth settling it first - A two-step automation in a no-code tool you already use does the job #### A workflow I've automated 1. **Sources:** A hand-picked list of news sources 2. **Collect:** New stories are scraped from each source 3. **Track:** PostgreSQL records every source and article 4. **Write:** OpenAI turns each story into an original article in Spanish 5. **Illustrate:** A matching thumbnail is generated 6. **Publish:** The finished article goes to WordPress The pipeline behind El Pueblo Informa, a Spanish news site, from the AI-Powered News Automation case study. Python and FastAPI run each step. #### What every automation includes - **A workflow map first:** Before writing code, I write down each step, the tools it touches, who owns it and what should happen when it fails. You approve the map, and it becomes the scope. - **Integrations with your tools:** CRMs such as HubSpot or Pipedrive, email, Google Sheets, Slack, databases and any tool with an API or webhooks. For AI workflow automation with CRM integration, records are matched before they're created, so you don't end up with duplicates. - **Retries and failure recovery:** Calls to outside services retry with back-off. Steps are written so running them twice doesn't create duplicates, and anything that still fails goes to a list you can review and re-run, with an alert by email or Slack. - **Approval steps:** Where a mistake would be costly, such as emailing a customer, changing a deal or publishing, the workflow pauses and asks a person to approve, edit or reject. - **Logs you can read:** Every run is logged with its inputs, outputs and AI decisions, so you can see what happened and why. - **The right tool for it:** Custom Python when the logic is complex or the volume is high, or a visual tool such as n8n when your team wants to edit the flow themselves. The comparison guide below walks through both. #### Built before: AI-Powered News Automation - Collects new stories from a hand-picked list of sources - Writes each story as a fresh, readable article in Spanish - Generates a matching thumbnail for every post - Publishes finished articles directly to WordPress - Python and FastAPI for the pipeline, PostgreSQL to track sources and articles, OpenAI for text and images Case study: https://www.saifcodes.com/projects/ai-powered-news-automation #### What you pay for - **Build (Me, one time):** A fixed quote after a free scoping call, based on the approved workflow map. For a fixed-price start, AI blog automation in WordPress is $300. - **Model usage (Your AI provider):** Billed to your own account. It grows with the number of runs and the amount of text each AI step reads. - **Hosting and tools (Your providers):** A small server, or the paid plan of the automation tool, plus any paid plans for the apps being connected. - **Support (Me, optional after launch):** Bug fixes are covered for the support window. You also get a handover document listing every schedule, alert and credential location, so someone else could maintain it. After that, changes are quoted, or you can hire me monthly from $1,500. #### FAQs - **Which tools can you connect?** Anything with an API or webhooks, which covers most CRMs, help desks, email providers, spreadsheets, databases and chat tools. If a tool has no API, browser automation is sometimes an option, and I'll tell you how fragile that would be. - **Should we use n8n, Zapier or custom code?** It depends on who will maintain it, how complex the logic is and how many runs you expect. The n8n vs custom Python guide walks through the same workflow built both ways. - **What if an AI step gets something wrong?** That's what approval steps and logs are for. Costly actions wait for a person, every AI decision is logged, and we review the first runs together before the workflow runs unattended. - **What does it cost to run?** Usually the AI usage plus a small server or an automation tool's paid plan. I estimate it in the scope from your expected volume. ### AI Chatbot Development: Support Bot with Lead Capture Source: https://www.saifcodes.com/services/ai-chatbot-development A chatbot on your site that answers visitors' questions from your own content and collects their details when they're interested. Setup is $300, paid once. AI usage and hosting are billed to you directly by the providers. A good fit if: - Visitors ask the same questions before they buy or book - Enquiries arrive outside working hours and go cold - Your answers are already on public pages, in docs or in FAQs Probably not a fit if: - Answers must come from internal or confidential documents. That's custom RAG development - You need a live-chat inbox with a team of agents #### How the chatbot works - **Data sources:** I index your website pages plus any docs and FAQs you provide. When your content changes, the index can be refreshed so answers stay current. - **Lead capture:** When a visitor shows interest, the bot asks for their name, email and what they need, and sends it to your email or one CRM. - **Handoff rules:** The bot offers a person when it can't find an answer in your content, when the visitor asks for a human, or when the topic is one you've marked as sensitive, such as refunds or complaints. It collects contact details and notifies you, or shows your WhatsApp, email or booking link. - **Guardrails:** It's instructed to answer only from your content and to hand off rather than guess about prices, policies or promises. - **Works on your site:** It embeds with one script tag, so it works on WordPress, Shopify, Webflow, Wix or a custom site. #### Setup versus recurring costs - **Setup (Me, one time: $300):** Indexing your content, the chat widget, lead capture, one email or CRM destination, handoff rules and deployment. - **Model usage (Your AI provider, monthly):** Billed per token to your own account. It depends on how many conversations the bot has. - **Hosting (Your hosting provider, monthly):** Nothing extra if it runs on a server you already have, otherwise a small server. - **Changes (Me, optional):** Bug fixes are covered for the support window. Extra integrations, more languages or new features are quoted separately. #### FAQs - **Which websites does it work on?** Any site where you can add a script tag, including WordPress, Shopify, Webflow, Wix and custom sites. - **Can it answer in other languages?** Multiple languages are quoted separately, because each one needs its own testing. - **Can it look up orders or bookings?** Not in this package. Connecting it to order or booking systems is custom work, quoted after a short call. ### PHP Security Patching for CVE-2026-109618 and CVE-2026-109619 Source: https://www.saifcodes.com/services/php-security-patching CVE-2026-109618 and CVE-2026-109619 let anyone who can reach your website run code on your server without logging in. I patch every PHP version you run: supported versions get the official update, old versions get the fix backported into a patched build of the same version, and your own code is fixed where an attack can reach it. A good fit if: - You run PHP on a VPS, a dedicated server, containers or cloud instances you have root access to - Some sites are stuck on PHP 7.4, 8.0 or 8.1 and can't be upgraded this week - You use Apache with mod_php, the setup most at risk - You want the work checked and written up, not just a package update run Probably not a fit if: - You're on shared hosting without root access. Only your host can patch PHP there - Your server is already compromised. That needs incident response and a rebuild first, quoted separately - You want your app moved to a newer PHP version. That's an upgrade project, quoted separately #### How I patch your servers - **Audit:** I list every server, container image and PHP version you run, how PHP is connected to the web server (mod_php, PHP-FPM, LiteSpeed or FrankenPHP), and whether your packages already contain the fix. Distributions often fix PHP without changing the version number, so I check the package changelog, not just the version. - **Mitigate first:** Before changing any binaries, I turn off session upload progress and tighten request limits at server level, so the known attack routes are closed within minutes while the real fix is prepared. - **Official updates:** PHP 8.2, 8.3, 8.4 and 8.5 are updated to the fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12) or your distribution's patched packages. Then PHP-FPM, Apache, queue workers and other long-running PHP processes are restarted, so no worker is left running the old code. - **Patched builds for old PHP:** For PHP 7.4, 8.0 and 8.1, I compile PHP from the PHP project's own backport branches, with the same version, extensions and build options as your current install. Your app runs on the same PHP version with the security fix added. For older versions with no published backport, I port the fix to the old source by hand. - **Custom code patches:** I review the parts of your application that attackers can push into running out of memory, such as upload handlers and endpoints that parse large input, and add size limits, web server request limits and least-privilege file permissions where they're missing. - **Test, switch over, report:** The patched PHP is installed alongside the current one and tested with your sites before switching over, with a rollback plan if anything breaks. You get a written report covering each server, what was changed, how the fix was verified and what still needs upgrading. #### What it costs - **Quick patch (Me, one time: $100):** One server on a supported PHP version (8.2 to 8.5): audit, mitigation settings, the official update, restarting every PHP process, and a short report. - **Old PHP version (Me, one time: $300 – $600):** A patched build of PHP 7.4, 8.0 or 8.1 with your exact extensions, installed alongside the current PHP, tested with your sites, switched over with a rollback plan. The price depends on how unusual the build is and how many servers get it. - **Full hardening (Me, one time: up to $1,200):** Several servers or container images, mixed PHP versions, hand-ported fixes for PHP older than 7.4, and custom code patches in your application, plus a check for signs of compromise on servers exposed before patching. - **Your providers (You, directly):** Server and hosting costs, control panel licences, and extended-support PHP builds if you'd rather buy one than use a backport. #### FAQs - **Can't I just run apt upgrade?** On a supported PHP version from a patched repository, mostly yes, and the guide below shows how. The usual misses are workers that weren't restarted, a second PHP version on the same server, container images that weren't rebuilt, and hosting panels that ship their own PHP builds. The $100 patch covers all of that. - **Is a backported PHP build safe to run?** It's built from the PHP project's own backport branches where they exist, with your existing version and extensions, and tested before switching over. It closes these two vulnerabilities, but old PHP versions have other unfixed bugs, so I'd still plan an upgrade to a supported version. - **Will patching break my site?** The official update and a backported build keep the same PHP version, so applications rarely notice. I test before switching over and keep the old binaries ready, so rolling back takes minutes if anything does break. - **What access do you need?** SSH with sudo on each server, or access to your container build pipeline. I work on accounts you control and can use a temporary user that you remove afterwards. - **Can you tell if we were already hacked?** The full hardening package includes a check for common signs of compromise, such as new PHP files, unexpected cron jobs and suspicious processes. If something turns up, cleaning up and rebuilding the server is quoted separately, and secrets should be rotated. - **Do you patch other PHP vulnerabilities too?** Yes. The same approach works for any PHP security release: audit, mitigate, update or backport, test and report. ## Guides ### How Much Does a Custom RAG System Cost to Build and Run? Source: https://www.saifcodes.com/guides/rag-development-cost (updated 2026-10-20) A RAG (retrieval-augmented generation) system has two kinds of cost: **building it**, which you pay once, and **running it**, which you pay every month to your AI and hosting providers. Most confusion comes from mixing the two, so this guide keeps them apart and shows the arithmetic, so you can redo it with your own numbers. #### What drives the build cost Retrieval and generation are the easy part. Most of the effort goes into getting your documents in cleanly, enforcing who can see what, and proving the answers are right. These are the things that move a quote up or down: | Driver | Simpler end | More work | | --- | --- | --- | | Sources | One folder of PDFs or a website | Several systems kept in sync (drives, wikis, CRM, databases) | | Document formats | Clean text, HTML, Markdown | Scanned PDFs, tables, spreadsheets, slides | | Permissions | Everyone can see everything | Per-user access copied from the source systems | | Interface | A chat widget or a simple web app | Inside your product, Slack or Teams, with single sign-on | | Evaluation | A small question set checked by hand | A larger test set run automatically after every change | | Hosting | Managed model APIs on your existing servers | Self-hosted models on GPU servers in a private network | ##### Where my prices sit - **Website support chatbot with lead capture: $300 one-time.** Public content only, one lead destination. [Scope and running costs](https://www.saifcodes.com/services/ai-chatbot-development). - **Custom RAG development: fixed quote after a free scoping call.** Internal documents, permissions, citations, an evaluation set and hosting on your infrastructure. [What's included](https://www.saifcodes.com/services/rag-development). - **Ongoing work: from $1,500 a month** for teams that want RAG systems and automations improved month after month. API usage and hosting are always billed to your own accounts, so the build price never hides a markup on running costs. #### How to estimate running costs Model providers charge per **token**, a chunk of text a little shorter than a word. Each question costs: - **Input tokens:** your instructions, any chat history, the question, and the passages retrieved from your documents. The retrieved passages are usually most of it. - **Output tokens:** the answer the model writes. Output usually costs several times more per token than input. So the monthly model cost is: > **(questions per month × input tokens per question × input price) + (questions per month × output tokens per question × output price)** Embedding your documents for search is a separate, mostly one-time cost. You pay it again only for documents that change. #### Three scenarios The assumptions are deliberately round so you can swap in your own: - About **650 tokens per page** (roughly 500 English words). Other languages often use more tokens per word. - Input per question = retrieved passages plus about 500 to 1,000 tokens of instructions and history. - Questions per month = people × questions per working day × 21 working days. | | A. Website support bot | B. Internal docs Q&A | C. Knowledge base with permissions | | --- | --- | --- | --- | | Content | 200 web pages | 2,000 documents (~10,000 pages) | 20,000 documents (~100,000 pages) | | Tokens to embed once | ~130,000 | ~6.5 million | ~65 million | | Questions per month | 3,000 | 4,000 (20 people × ~10 a day) | 10,000 (100 people × ~5 a day) | | Input tokens per question | 2,500 (5 passages) | 4,000 (6 passages) | 5,000 (8 passages) | | Output tokens per question | 250 | 400 | 500 | | **Input tokens per month** | **7.5 million** | **16 million** | **50 million** | | **Output tokens per month** | **0.75 million** | **1.6 million** | **5 million** | | Typical hosting | An existing web server | A small server with PostgreSQL and pgvector | A database server or managed vector database, plus permission sync jobs | ##### Turning tokens into dollars Multiply by your provider's current prices. To show the arithmetic, here are two **illustrative** price points per million tokens. They are round numbers, not quotes, so check your provider's pricing page before relying on them. | Monthly model cost | A | B | C | | --- | --- | --- | --- | | Smaller model at $0.50 input / $2 output | $5.25 | $11.20 | $35 | | Larger model at $3 input / $15 output | $33.75 | $72 | $225 | For example, scenario B on the larger model is 16 × $3 + 1.6 × $15 = $48 + $24 = **$72 a month**. Embedding is usually small by comparison. At an illustrative $0.10 per million tokens, embedding all of scenario C once costs about $6.50. #### Limits of these estimates - **Agents multiply calls.** If a question triggers several model calls, such as rewriting the query, checking the answer or using tools, multiply the input and output tokens by the number of calls. - **Self-hosted models change the picture.** GPU servers are billed by the hour whether or not anyone asks a question, and they're often the biggest line item. They make sense when text can't leave your servers or volume is very high. - **People time isn't included.** Someone has to keep the documents current and review failed questions. - **Prices change.** Provider prices have changed often. Recheck them before you budget. #### Ways to keep running costs down - **Retrieve fewer, better passages.** A re-ranking step that keeps the best 4 passages instead of 10 can cut input tokens roughly in half. - **Route simple questions to a smaller model** and save the larger one for hard questions. - **Trim chat history** to what the next answer needs. - **Cache answers** to frequent questions. - **Re-embed only changed files** instead of the whole library. Want an estimate for your own documents and volume? [Book a scoping call](https://www.saifcodes.com/services/rag-development) and you'll get the build quote and a running-cost estimate, with the assumptions written down. ### How to Hire an AI Developer: A Checklist for Startups and Small Teams Source: https://www.saifcodes.com/guides/hire-ai-developer (updated 2026-10-20) Hiring an independent developer for an AI project is less risky than it looks if you agree on three things before work starts: **what exactly is being built**, **how you'll know it works**, and **what you'll own at the end**. This guide gives you a checklist for each. #### Start with the problem, not the model Before talking to anyone, write down: - **The task.** One workflow or one set of questions, such as "answer staff questions about our HR policies" or "turn inbound leads into CRM records with a drafted reply." - **Who uses it** and where: a web app, Slack, your product, email. - **The data** it needs, where that data lives and who owns it. - **What a good result looks like**, in terms you can check, such as "cites the right policy for 9 of 10 test questions." - **Your budget for building it and for running it monthly.** These are separate numbers. See [how RAG costs add up](https://www.saifcodes.com/guides/rag-development-cost). #### Scoping checklist A good written scope answers every one of these. If a proposal skips one, ask about it. - [ ] The single workflow or question set this project covers - [ ] Data sources, file formats, rough size and who can grant access - [ ] Who should be able to see what - [ ] Integrations: CRM, single sign-on, Slack, email, databases - [ ] Where it runs, and who pays for hosting and API usage - [ ] How success is measured: the evaluation plan - [ ] What's explicitly out of scope - [ ] Milestones, and what you'll see working at each one - [ ] The support window after launch, and what happens after it - [ ] Who owns the code, the accounts and the data #### Questions to ask a developer | Ask | A good answer sounds like | | --- | --- | | What would you build first, and when will I see it working? | A specific first milestone with a demo on your own data, not only at the end. | | How will we know it works? | A test set of real examples with expected results, agreed before launch and rerun after changes. | | What will it cost to run each month? | An estimate from your expected volume, with the assumptions written down. | | What happens when the AI is wrong? | Source citations, a fallback to "I don't know," approval steps for costly actions, and logs. | | Where does our data go? | The model providers and storage named, plus options if text can't leave your servers. | | What do I get at the end? | Code in your repository, documentation, and services running on accounts you control. | #### Look at real work Ask for things you can check: live products, public code, or case studies that explain how a system was built, not only what it does. Ask the developer to walk you through a failure in a past project and how they fixed it. You'll learn more from that than from a list of frameworks. For example, my [Folio PDF](https://www.saifcodes.com/projects/folio-pdf) app is open source, so you can read the code and its tests, and my [case studies](https://www.saifcodes.com/projects) explain how each system works. #### What to check in the code at handover Even if you don't read code, you can check most of this list. If you can, pay another engineer for an hour to review it. That costs far less than finding problems later. - [ ] The repository is in your organization's account, not the developer's - [ ] A README explains how to run it locally and how to deploy it - [ ] API keys and passwords are in environment variables or a secrets manager, never in the code - [ ] Model names and providers are configuration, so you can switch them without a rewrite - [ ] Tests cover the core logic, and the evaluation set can be rerun with one command - [ ] Errors are logged and someone is alerted when something fails - [ ] Dependencies are pinned to versions - [ ] A short note explains the architecture and why the main choices were made #### An evaluation plan you can agree on An evaluation plan turns "it seems to work" into a result you can measure. For a document Q&A system it might look like this: | Part | Example | | --- | --- | | Test set | 50 real questions from your team, 10 of them with no answer in the documents | | Expected result | The correct answer and the document it should cite, or "I don't know" for the 10 | | Pass criteria | Agreed together, such as 45 of 50 correct with the right source, and no invented answers to the 10 | | When it runs | Before launch and after every change to retrieval, prompts or models | | Who keeps it | You. It stays useful long after the project ends | For an automation, the same idea works with past real cases: run last month's inputs through the workflow and compare its decisions with what your team actually did. #### A delivery process that protects you - **Milestones you can see working.** Each one ends with a demo on your data, and payments are tied to them. - **Written change requests.** New ideas during the project are fine. Agree the cost and timing in writing before work on them starts. - **Early access to the real thing.** A staging version you can try beats screenshots. - **A proper handover.** Code, documentation, a recorded walkthrough and a list of every account and credential location. #### Red flags - Promises of 100% accuracy - No answer on monthly running costs - Nothing to see until the end of the project - Code or services kept in the developer's own accounts - No plan for when the model gets something wrong If you'd like to see how I scope and deliver this kind of work, start with [custom RAG development](https://www.saifcodes.com/services/rag-development) or [AI workflow automation](https://www.saifcodes.com/services/ai-workflow-automation). ### n8n vs Custom Python for AI Workflow Automation Source: https://www.saifcodes.com/guides/n8n-vs-custom-python-automation (updated 2026-10-20) n8n and custom Python can both run an AI workflow reliably. The better choice depends less on features than on **who will maintain it**, **how complex the logic is** and **how much volume it handles**. The clearest way to compare them is to build the same workflow both ways. #### The example workflow A lead fills in the form on your website. The workflow should: 1. Receive the form submission. 2. Look up the company to add context. 3. Ask an AI model to classify the lead (sales, support or spam) and draft a reply. 4. Create the contact in HubSpot, or update it if the email already exists. 5. Post the draft in Slack for a person to approve or edit. 6. Email the approved reply to the lead. It's a typical AI workflow with a CRM integration: one AI step, two outside systems, and a person in the loop before anything reaches a customer. #### Built in n8n In n8n, each step is a node on a visual canvas: 1. **Webhook** node receives the form submission. 2. **HTTP Request** node calls the company lookup API. 3. **OpenAI** node classifies the lead and drafts the reply, asked to return JSON. 4. **If** node stops spam here. 5. **HubSpot** node creates or updates the contact by email. 6. **Slack** node sends the draft and waits for a response, so the workflow pauses until someone approves. 7. **Send Email** (or Gmail) node sends the approved reply. For reliability, turn on **Retry On Fail** for the HTTP Request and HubSpot nodes, and set an **error workflow** that starts with an Error Trigger node and posts failures to Slack. Someone familiar with n8n can build the first version quickly, and anyone on your team can open the canvas and see what happens to a lead. #### Built in custom Python In Python, the same workflow is a small FastAPI service with a background worker. Here is a simplified sketch: ```python from typing import Literal from fastapi import FastAPI from pydantic import BaseModel from tenacity import retry, stop_after_attempt, wait_exponential app = FastAPI() class Lead(BaseModel): name: str email: str message: str class Triage(BaseModel): intent: Literal["sales", "support", "spam"] reply_draft: str @app.post("/webhooks/lead") def receive_lead(lead: Lead): lead_id = db.save_lead(lead) # store first, so no lead is ever lost queue.enqueue(process_lead, lead_id) # the slow work happens in the background return {"ok": True} @retry(stop=stop_after_attempt(5), wait=wait_exponential(min=2, max=60)) def upsert_contact(lead: Lead, triage: Triage) -> str: ... # HubSpot API: search by email, then create or update def process_lead(lead_id: int): lead = db.get_lead(lead_id) company = lookup_company(lead.email) triage = classify(lead, company) # model output validated against Triage if triage.intent == "spam": return db.mark(lead_id, "spam") upsert_contact(lead, triage) slack.request_approval(lead_id, triage.reply_draft) # buttons call back to /webhooks/slack ``` A second endpoint receives the Slack button click and sends the email. Because every lead is saved before processing, a failed run can be retried from the database without asking the visitor to submit the form again. It takes longer to build than the n8n version. In exchange, the logic is ordinary code that can be tested, reviewed and moved anywhere. #### Maintenance tradeoffs | | n8n | Custom Python | | --- | --- | --- | | First version | Fast, especially with built-in integration nodes | Slower, with more setup | | Who can change it | People on your team who know n8n, on the visual canvas | A developer | | Complex logic | Gets hard to follow as branches and Code nodes pile up | Ordinary functions with tests | | Testing | Mostly manual runs with saved sample data | Unit tests and evaluation sets that run on every change | | Version control | Workflows are JSON. Built-in Git sync is on higher-tier plans | Git, code review and rollbacks as usual | | Error handling | Per-node retries and error workflows | Whatever you build: retries, duplicate protection, failed-job queues | | Hosting | n8n Cloud, priced by workflow executions, or self-hosted | A small server or serverless functions | | Lock-in | The logic lives in n8n's format | Plain code you can run anywhere | Both need upkeep. n8n upgrades can change how nodes behave, Python dependencies need updating, and in both cases API keys need rotating and someone has to watch the failure alerts. #### When to choose which **Choose n8n when:** - The steps are mostly standard integrations that n8n already has nodes for - Volume is low to moderate - Someone on your team wants to adjust the flow without a developer - You're testing whether the workflow is worth automating at all **Choose custom Python when:** - The logic branches a lot, or the AI step is substantial, such as retrieval from your documents or multi-step reasoning - Volume is high, or runs must finish quickly - You need automated tests, code review or an audit trail for compliance - The workflow belongs inside your own product **Or use both.** n8n handles the triggers and app connections, and calls a small Python service over HTTP for the AI-heavy step. Your team keeps a readable canvas, and the hard logic stays in tested code. If you have a workflow in mind and aren't sure which way to build it, [tell me about it](https://www.saifcodes.com/services/ai-workflow-automation). The workflow map I write at the start of every automation project includes this choice and the reasons for it. ### PHP2Shell (CVE-2026-109618 and CVE-2026-109619): How the PHP Bugs Work, What They Can Cost You and How to Patch Source: https://www.saifcodes.com/guides/php2shell-cve-2026-109618-109619 (updated 2026-10-22) On **21 October 2026** the PHP project released fixes for two critical vulnerabilities, **CVE-2026-109618** and **CVE-2026-109619**, now widely called **"PHP2Shell"**. Both let an attacker who can send HTTP requests to your server run their own code on it, without logging in. Both are rated **9.2 out of 10** (CVSS v4.0). If you run PHP on a server you manage, whether it's WordPress, Laravel, Magento, Drupal or a custom app, treat this as urgent. This guide explains what the bugs are, who is most exposed, what a break-in can cost and exactly how to patch, including on old PHP versions that no longer get official updates. #### The short version | | | | --- | --- | | **What** | Two memory-safety bugs in PHP itself, not in WordPress, Laravel or any framework | | **Impact** | Unauthenticated remote code execution with the privileges of the web server's PHP worker | | **Severity** | 9.2 (CVSS v4.0). A score of 10.0 that circulated on 20 October was wrong | | **Fixed in** | PHP **8.5.12**, **8.4.27**, **8.3.36** and **8.2.35** | | **Old versions** | PHP 8.1 and older get no official release. Source-code backports exist for 7.4, 8.0 and 8.1 | | **Most at risk** | Apache with **mod_php**, where the attack can succeed before any of your code runs | | **Also affected** | PHP-FPM, php-cgi, FrankenPHP and LiteSpeed | | **Temporary mitigation** | Turn off `session.upload_progress` and tighten request limits. These reduce risk but are not a fix | #### How PHP handles a request Both bugs live in the part of PHP that sets up and cleans up each web request, so it helps to know that lifecycle first. PHP doesn't start a fresh process for every visitor. A pool of **worker processes** (Apache's prefork workers with mod_php, or a PHP-FPM pool) handles requests one after another. For each request a worker: 1. **Starts up the request.** It reads the incoming data: form fields, uploaded files, cookies and session information. 2. **Runs your code.** WordPress, Laravel or whatever your app is. 3. **Shuts down and cleans up.** It frees the memory the request used, so the worker is ready for the next visitor. Two settings matter here. **`memory_limit`** caps how much memory one request may use. When a request hits that limit, PHP stops it immediately with a fatal error. And because workers are reused, anything not cleaned up properly after one request can still be there when the next request arrives. #### CVE-2026-109618: memory corruption when a request runs out of memory When a request hits `memory_limit`, PHP abandons it straight away. The bug is that this can happen **while PHP is halfway through setting up some internal data**. The data is left partly initialized, and the cleanup step that runs afterwards treats it as valid. Working on half-built data corrupts memory, and an attacker who can shape that corruption can take over the process. The PHP Foundation describes it as a request reaching `memory_limit` "at exactly the wrong moment". According to Rapid7's analysis of the advisory: - An attacker can force that moment with **crafted multipart requests**, the format used for forms and file uploads. These can exhaust memory even when their size looks like it's within PHP's configured limits. - Application code that allocates memory based on what a visitor sends can also trigger it. - **With Apache mod_php, cleanup runs even when request startup fails.** So the attack works on the incoming request itself, before your application code is involved. The advisory reports a working attack over plain HTTP with PHP's default input and memory limits. **What about PHP-FPM?** Here the sources differ. Rapid7 and Qualys say FPM ends a worker when request startup fails, which blocks the specific startup attack, and Rapid7 says the advisory reports no complete FPM exploit for this CVE. The PHP Foundation says remote code execution was also confirmed on FPM through application-level code paths. Assume FPM is exploitable and patch it too. #### CVE-2026-109619: stale data from an earlier request (use-after-free) The second bug is about what a worker carries from one request to the next. If a request ends with a **fatal error**, such as running out of memory or hitting the execution time limit, the cleanup step can be cut short. Some internal state is left **pointing at memory that has already been freed**. When the next request handled by the same worker uses that state, PHP reads and writes memory that may now hold something else. This kind of bug is called a **use-after-free**, and it's a well-known route to running attacker-controlled code. Rapid7 describes two ways to reach the stale state: - **Session upload progress.** This PHP feature reports how far a file upload has got, and it's **on by default**. It reads session data very early in a request, before normal setup, and it does so even if your application never calls `session_start()`. That makes it an ideal early consumer of the stale state. The attack has been confirmed against both mod_php and PHP-FPM. - **Fatal error backtraces (PHP 8.5 only).** The `fatal_error_backtraces` setting, on by default in 8.5, gives a second route on mod_php. On FPM the attacker needs more: a request that leaves stale state behind, a fatal error, and then a second request that lands **on the same worker**. That's harder, not impossible. Qualys also reports that researchers have shown the bugs can **leak a worker's memory** without logging in. That memory can hold database passwords, session tokens and API keys. No other source I read confirms this, but it's a good reason to rotate secrets if you were exposed (see below). #### Which servers are most at risk | Setup | Risk | Why | | --- | --- | --- | | Apache + mod_php | **Highest** | Both bugs can be triggered before your code runs | | PHP-FPM behind Nginx or Apache | High | The CVE-2026-109619 session route is confirmed, and the PHP Foundation reports FPM code execution for CVE-2026-109618 too | | FrankenPHP, LiteSpeed, php-cgi | High | Listed as affected. Long-running workers keep state across many requests | | Docker images built on `php:*` | Depends on the base image | Old images keep the vulnerable PHP until you rebuild and redeploy | | Shared hosting | Depends on your host | Only the host can patch PHP. Check their status page | | PHP on the command line only | Lower | Not discussed by the advisories, since there are no outside HTTP requests. Long-running queue workers still need restarting after the update | #### Timeline According to the PHP Foundation's account of the release: | When (UTC) | What happened | | --- | --- | | 11 August 2026 | Calif and OpenAI report the out-of-memory root cause to the PHP security team | | 20 October, ~15:00 | The CVE IDs leak online with the wrong release date and the wrong score (10.0). No technical details leaked | | 20 October, 19:30 | PHP publishes a pre-announcement early because of the leak | | 20 October, ~20:00 | A proof-of-concept video showing attacks on several targets is accidentally posted | | 21 October, 07:41 | Fixed container images are published before the planned release time | | 21 October, 14:00 | PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 are released, a day earlier than planned | **Is it being exploited?** The PHP Foundation says it had not identified any working exploits at the time of release. Rapid7 expects exploitation in the wild and a public exploit soon. Qualys reports that exploitation attempts have been seen in the wild, citing reports from Amazon, Cloudflare and Patchstack. With a video of the attack already public, patch as though attacks have started. #### What a successful attack can cost you Code execution as the PHP worker means the attacker can do anything your website can do. In practice that includes: - **Stealing your data.** The worker can read your application's config files, including `.env` and `wp-config.php`, so the attacker gets your database password and with it your customer records, orders and password hashes. - **Stealing secrets and money.** API keys for payment providers, email services, cloud storage and AI providers are usually in the same config files. Stolen cloud keys can run up large bills, for example by mining cryptocurrency on your account. - **Skimming payment cards.** Attackers can inject JavaScript into checkout pages that copies card details as customers type them. You may not notice for weeks. - **Planting backdoors.** Hidden PHP files or cron jobs let the attacker come back even after you patch, which is why patching alone doesn't clean an already compromised server. - **Ransomware and data loss.** Files and databases the worker can reach can be encrypted or deleted, including backups stored on the same server. - **SEO spam and blacklisting.** Spam pages and redirects get your domain flagged by Google and browsers, and organic traffic can take months to recover. - **Spam and abuse from your server.** Phishing emails sent from your IP get it blacklisted, so even your legitimate emails stop being delivered. - **Reaching the rest of your network.** A web server is often a stepping stone to databases, admin panels and internal systems. On top of the direct damage come **downtime**, the **cost of investigating and rebuilding** the server, and **legal obligations**. If personal data of people in the EU or UK is exposed, GDPR usually requires you to notify the regulator within 72 hours, and fines can reach €20 million or 4% of global annual turnover. If you take card payments, a breach also brings PCI DSS consequences from your payment provider. Patching is far cheaper than any of this. #### Step 1: Find out what you're running Check every server, container image and PHP version. Many servers have more than one installed. ```bash ### PHP version used on the command line php -v ### Every installed PHP binary and FPM service (Debian/Ubuntu layout) ls /usr/bin/php* /usr/sbin/php-fpm* 2>/dev/null ### Is Apache loading PHP as a module (mod_php)? apachectl -M 2>/dev/null | grep -i php ### Current state of the settings that matter here php -i | grep -E 'session.upload_progress.enabled|fatal_error_backtraces|memory_limit|post_max_size' ``` **Don't rely on the version number alone.** Debian, Ubuntu, Red Hat and other distributions often backport security fixes **without changing the PHP version** you see. Check the package changelog for the CVE IDs instead: ```bash ### Debian / Ubuntu (adjust the package name to your version) zgrep -E 'CVE-2026-10961[89]' /usr/share/doc/php8.3-fpm/changelog.Debian.gz ### RHEL, AlmaLinux, Rocky, Fedora rpm -q --changelog php-fpm | grep -E 'CVE-2026-10961[89]' ``` If both CVE IDs appear, that package is patched. #### Step 2: Apply the mitigation now If you can't patch within the hour, reduce the risk first. Set these at the **server level**: in `php.ini`, in each FPM pool with `php_admin_value`, or in the Apache config. Rapid7 notes that `ini_set()` in application code and FPM's `.user.ini` files take effect **too late** to help. ```ini ; php.ini: blocks the known routes for CVE-2026-109619 session.upload_progress.enabled = 0 ; PHP 8.5 only: closes the backtrace route fatal_error_backtraces = 0 ; Keep request bodies small: 8M if you don't accept uploads, 32M if you do post_max_size = 8M upload_max_filesize = 6M ``` For a PHP-FPM pool, the equivalent is: ```ini php_admin_flag[session.upload_progress.enabled] = off ``` Then restart PHP-FPM or Apache so every worker picks it up. The advisories also mention removing `memory_limit` (`-1`) to dodge the out-of-memory trigger. Rapid7 warns that an allocation failure can still reach the vulnerable code, and an unlimited limit lets a single request eat the server's memory, so treat that as a last resort. **None of these settings is a complete fix.** They buy you time to patch. #### Step 3: Patch ##### Supported versions (8.2, 8.3, 8.4, 8.5) Update to **8.2.35, 8.3.36, 8.4.27 or 8.5.12** or later, or to your distribution's patched package. ```bash ### Debian / Ubuntu, including the ondrej/php (sury.org) repositories sudo apt update && sudo apt install --only-upgrade 'php8.3*' ### RHEL family sudo dnf upgrade 'php*' ### Then restart every PHP service sudo systemctl restart php8.3-fpm # or: sudo systemctl restart apache2 ``` Things that are easy to miss: - **Restart everything that runs PHP.** Updating the package doesn't replace code that's already loaded in memory. Restart PHP-FPM, Apache, and long-running workers such as Laravel queues, Horizon, Octane, FrankenPHP and RoadRunner. - **Hosting panels don't always patch PHP for you.** Laravel Forge says its automatic security updates don't update PHP. On cPanel, Plesk and similar panels, check that the panel's own PHP builds have been updated, not just the operating system's. - **Rebuild container images.** Pull the fixed base image, rebuild your image and redeploy. A running container keeps the old PHP until it's replaced. - **Check every version on the server.** Patching `php8.3` does nothing for a site still running on `php7.4-fpm`. ##### Old versions (8.1, 8.0, 7.4 and earlier) PHP 8.1 and older are **end of life**, so there is **no official release** with these fixes. Your options: 1. **Distribution or vendor packages.** Some long-term-support distributions and extended-support PHP vendors ship patched builds of older versions. Check your vendor's advisory for the two CVE IDs. 2. **Build a patched PHP yourself.** The PHP project published source branches with the fixes backported to **7.4, 8.0 and 8.1**. You compile PHP from that source with the **same version, extensions and build options** as your current one, test it, then swap it in with a way back if anything breaks. Your application doesn't change, because it's the same PHP version with the security fix added. 3. **Even older versions (5.x, 7.0 to 7.3).** There's no published backport. The fix has to be ported by hand to the older code, which is skilled but doable work. 4. **Upgrade the application** to a supported PHP version. This is the right long-term answer, but it can take weeks if the code relies on old behaviour, so it's usually done **after** a backported build has closed the hole. A backported build closes these two holes. It doesn't fix the other bugs found in old PHP versions since they went end of life, so plan the upgrade anyway. ##### Your own code Patching PHP fixes the root cause. It's still worth closing the paths these attacks lean on in your application: - **Limit work driven by visitors' input.** Endpoints that build big arrays, decode large JSON or parse uploaded files based on a visitor's input are exactly where an attacker can force a request out of memory. Put size limits on them before processing. - **Reject oversized requests at the web server**, for example with Nginx's `client_max_body_size`, before PHP ever sees them. - **Remove reliance on upload progress** if your app uses it, so the setting can stay off for good. - **Run PHP with least privilege.** A worker that can't write to the web root or read unrelated secrets limits what a successful attack can do. #### Step 4: Check you weren't already hit None of the sources published reliable indicators of compromise, and Rapid7 points out that clean logs don't prove a server is safe. If a server was exposed before you patched, especially with mod_php, check: ```bash ### PHP files created or changed since the CVE IDs leaked find /var/www -name '*.php' -newermt '2026-10-20' -ls ### Cron jobs for the web server user sudo crontab -u www-data -l ### Processes running as the web server user, and network connections opened by PHP or Apache ps -u www-data -o pid,etime,cmd sudo ss -tunp | grep -E 'php|apache2|httpd' ``` If you find anything unexpected, treat the server as compromised: take it offline, rebuild it from a known-good image, and rotate **every** secret it held, including database passwords, API keys, the application key and session secrets. Even if nothing turns up, rotating secrets on an exposed mod_php server is a sensible precaution. #### Checklist - [ ] Listed every server, container image and PHP version in use - [ ] Turned off `session.upload_progress` at server level (and `fatal_error_backtraces` on 8.5) - [ ] Updated supported versions to 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or a patched distribution package - [ ] Patched or replaced every end-of-life PHP version - [ ] Restarted PHP-FPM, Apache and every long-running PHP worker - [ ] Rebuilt and redeployed container images - [ ] Confirmed the fix from the package changelog, not only the version number - [ ] Checked for signs of compromise and rotated secrets on exposed servers - [ ] Planned the upgrade off any end-of-life PHP version #### Sources - [PHP Foundation: Today's PHP security release, and how we're strengthening PHP security](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/) - [Rapid7: CVE-2026-109618 and CVE-2026-109619, critical unauthenticated remote code execution in PHP](https://www.rapid7.com/blog/post/etr-cve-2026-109618-and-cve-2026-109619-critical-unauthenticated-remote-code-execution-in-php/) - [Qualys: PHP2Shell, PHP patches two critical RCE vulnerabilities](https://blog.qualys.com/vulnerabilities-threat-research/2026/10/20/php-announces-critical-security-release-for-two-vulnerabilities) - [Laravel Forge: PHP security advisory](https://laravel.com/forge/docs/knowledge-base/php-security-release-october-2026) - [Codeable: what WordPress site owners need to do](https://www.codeable.io/blog/php-vulnerability-cve-2026-109618/) Need it done for you? I patch servers against these CVEs, including building patched PHP for old versions and fixing exposed paths in your code, for **$100 to $1,200** depending on how many servers and versions you have. [See what's included](https://www.saifcodes.com/services/php-security-patching). ## Case Studies Source: https://www.saifcodes.com/projects. Real projects for real clients; many other projects are under NDA. ### AI-Powered News Automation - URL: https://www.saifcodes.com/projects/ai-powered-news-automation - Category: SaaS/AI - Tech: Python, FastAPI, PostgreSQL, OpenAI, WordPress - Live site: https://elpuebloinforma.com/ A Spanish-language news site that mostly runs itself. The system gathers stories from trusted sources, writes original articles with AI and creates a thumbnail for each one, then publishes it all to WordPress. #### The challenge Running a news site means publishing all the time. My client wanted to keep up with the news cycle without paying for a full editorial team. #### What I built - **Source scraping:** collects new stories from a hand-picked list of sources. - **AI writing:** turns each story into a fresh, readable article in Spanish. - **Thumbnails:** generates a matching image for every post. - **Auto-publishing:** sends finished articles directly to WordPress. #### Tech behind it - **Python + FastAPI** for the pipeline and API. - **PostgreSQL** to track sources and articles. - **OpenAI** models for writing and images. - **WordPress** as the public site. ### Facial Verification & KYC System - URL: https://www.saifcodes.com/projects/facial-verification - Category: AI/CV - Tech: Python, OpenCV, Flask, MySQL Identity checks without the paperwork. A user takes a selfie, uploads their CNIC or passport, and the system tells them right away whether the two faces match. #### The challenge Checking IDs by hand is slow, and it gets harder as more people sign up. My client needed a KYC (Know Your Customer) step that could verify people automatically and still give them clear feedback in the moment. #### What I built - **Document upload:** users submit a CNIC, passport or other ID. - **Live selfie check:** a live photo is captured and compared against the face on the document. - **Face matching:** computer vision lines up a live face with a printed or scanned photo, even though the two look quite different. - **Instant feedback:** users see their verification result right away instead of waiting for a manual review. #### Tech behind it - **Python + OpenCV** for face detection and matching. - **Flask** for the API. - **MySQL** to store user records and verification logs. ### Folio PDF – Native iOS PDF Reader - URL: https://www.saifcodes.com/projects/folio-pdf - Category: iOS App - Tech: Swift, SwiftUI, PDFKit, SwiftData, UIKit, Swift Concurrency, XCTest - Source code: https://github.com/msaifmumtaz/folio-pdf A native PDF reader for iPhone that feels like reading a real book. Folio keeps your library organized, remembers where you stopped and lets you highlight, underline and draw on any page. Everything stays on your phone: no accounts, no analytics and no network requests. #### The challenge Most PDF apps on the App Store are either bare file viewers or heavy office suites full of subscriptions, sign-ins and cloud uploads. I wanted a reader built just for reading: fast with 800-page books, pleasant for long sessions and fully private. It also had to be safe with your files. Annotating a PDF should never risk damaging the original. #### What I built - **Library:** folders, grid and list layouts, title search and a *Continue reading* card that reopens your last book on the page you left. Each cover shows your reading progress. - **Two reading modes:** smooth vertical scroll, or *Flip*, a book-style page curl with an optional page-turn sound and volume control. - **Annotations:** highlight, underline, strikethrough, pen drawing and notes, with undo/redo and autosave after every edit. - **Safe exports:** *Share PDF* creates a copy with your annotations embedded. The original file is never modified, and password-protected PDFs keep their protection. - **Navigation:** bookmarks, page thumbnails, a page scrubber, jump-to-page and full-text search. - **Private by design:** no backend, no accounts and no tracking. Passwords for protected PDFs are never stored. - **Built for everyone:** light and dark themes, Dynamic Type, VoiceOver actions and Reduce Motion support. #### How it works under the hood - **Originals stay byte-identical.** Annotations are saved in a separate, versioned JSON file for each document and are only merged into the PDF when you export. If you never annotate, *Share* sends the original bytes unchanged. - **Imports you can trust.** Files are streamed in through a temporary file while they are hashed with SHA-256, so an interrupted import never leaves a broken file behind. Importing the same PDF twice reuses the existing entry. - **No lost work.** Every edit becomes an ordered save snapshot that is written atomically. If a save fails, a banner offers *Retry* and the reader stays open until your changes are safe. - **Smooth with big books.** File work and thumbnail rendering run on their own Swift actors, away from the main thread, so scrolling and saving never wait on each other. Thumbnails are cached in memory (32 MB) and on disk (24 MB), and pages from decrypted PDFs are never written to disk. - **Safe upgrades.** The library store is versioned. Before a migration runs, the old data is backed up automatically. - **Tested:** 65 unit tests and 26 UI tests cover the library, both reading modes, migrations and performance. #### Tech behind it - **Swift + SwiftUI** for the whole interface, with **UIKit** only where PDFKit needs it: the PDF view, the page-curl controller and drawing gestures. - **PDFKit** for rendering, text selection, search and annotations. - **SwiftData** for the library, folders, bookmarks and reading progress. - **Swift Concurrency** (actors and `@MainActor`) to keep file work, rendering and UI separate. - **XCTest + XCUITest** for unit and end-to-end UI tests. - **Zero third-party dependencies.** Folio uses only Apple frameworks, so it is small, fast and easy to maintain. Folio is open source under the MIT License. [View the source code on GitHub](https://github.com/msaifmumtaz/folio-pdf). ### Automated Web Form Filling System - URL: https://www.saifcodes.com/projects/form-filling - Category: Automation - Tech: Node.js, Puppeteer, Residential Proxy, PHP, JavaScript - Live site: https://webautoma.com/ My client needed to submit huge numbers of web forms, across many different websites, without anyone sitting at a keyboard. So I built a browser automation platform that does the work on its own and is managed from a simple dashboard. #### The challenge Filling a form once is easy. Filling it at scale is not. Websites spot repeated traffic quickly, captchas get in the way, and every site has a different layout. The system had to look like a real person on every visit and be easy for a non-developer to run. #### What I built - **Field mapping:** set up a form's fields and buttons once, then reuse that setup as often as you like. - **Bulk uploads:** drop in a CSV and the system works through every row by itself. - **Location-aware proxies:** traffic is sent through residential proxies that match each website's region. - **Human-like browsing:** rotating user agents and natural interaction patterns so submissions don't look automated. - **Captcha handling:** captchas are detected and solved automatically. - **Admin dashboard:** one place to manage proxies, form lists, CSV data, users and results. #### Tech behind it - **Node.js + Puppeteer** run the browser automation. - **Residential proxies** provide real-world IPs. - **PHP, HTML, CSS & JavaScript** power the admin dashboard. ### Project Chat AI - URL: https://www.saifcodes.com/projects/project-chat-ai - Category: SaaS/AI - Tech: Python, FastAPI, PostgreSQL, OpenAI, Django, React, Next.js, PyTorch, Transformers, vLLM - Live site: https://projectchat.ai/ An AI assistant that actually knows your project. Upload your documents or connect Google Drive or Dropbox, and ask questions in plain English. It answers from your own data, not guesses. #### The challenge General chatbots are great at general questions, but they know nothing about *your* work. Teams kept copying and pasting documents into prompts. They needed an assistant that already had the context and kept every project separate. #### What I built - **Workspaces:** create a workspace for each project and upload the documents it should learn from. - **Cloud drive sync:** connect Google Drive, Dropbox and other drives so data comes in automatically. - **Answers grounded in your data:** an enterprise-grade RAG pipeline finds the right passages before the AI responds. - **Compare models side by side:** send one question to several AI models at once and pick the best answer. - **Parallel image generation:** create images with multiple models at the same time. - **Admin dashboard:** manage workspaces, users and data in one place. #### Tech behind it - **Python, FastAPI & Django** on the backend. - **React & Next.js** for the interface. - **PostgreSQL** for app data. - **GPT-4 and custom fine-tuned models**, served with **PyTorch, Transformers & vLLM**. ### Swimming Tracking & Analytics - URL: https://www.saifcodes.com/projects/swimming-tracking - Category: AI/CV - Tech: Python, OpenCV, Cloud, PHP, JavaScript Computer vision for the pool. Upload race footage or connect a live camera, and the system follows every swimmer, sees who touches the wall first and records each swimmer's time. #### The challenge Coaches and race organizers were timing swimmers by hand and rewatching footage to settle close finishes. They wanted accurate, repeatable results straight from the video, for both races and training. #### What I built - **Swimmer tracking:** finds each swimmer in the pool and follows them through the whole race. - **Finish detection:** works out who reaches the end of the pool first. - **Lap timing:** calculates how long each swimmer takes to cover the distance. - **Live or uploaded:** works with recorded videos and real-time camera feeds. - **Dashboard:** a simple web interface to upload footage and review results. #### Tech behind it - **Python + OpenCV** for detection and tracking. - **Cloud infrastructure** to process video at scale. - **PHP, HTML, CSS & JavaScript** for the dashboard. ### AI-Driven Twitter Automation - URL: https://www.saifcodes.com/projects/twitter-automation - Category: SaaS/AI - Tech: Python, GPT-4, Tweepy, Django, React A tool that runs a Twitter/X account almost by itself: it schedules posts, rewrites trending content in your voice, replies to mentions and DMs, and grows your audience, without sounding like a bot. #### The challenge Growing on Twitter/X means posting and replying all day, every day. My client wanted to keep the account active and engaging without spending hours on it, and without the stiff, robotic tone most automation tools produce. #### What I built - **Scheduled posting:** plan content ahead and let it go out on time. - **Find & rewrite:** pick up popular tweets in your niche and rewrite them with AI into something fresh and on-brand. - **Smart replies:** respond automatically to relevant tweets and mentions. - **DM replies:** answer direct messages automatically. - **Audience growth:** automated follow/unfollow and like/unlike to reach the right people. #### Tech behind it - **Python & Django** for the backend and dashboard. - **GPT-4** for writing and rewriting content. - **Twitter API + Tweepy** to connect to the platform. - **React, HTML, CSS & JavaScript** for the interface. ## Client Reviews From Upwork clients, as shown on the site: - "Excellent work and communication! Muhammad never fails to deliver an excellent work. Highly recommended!" (Angelo Angelucci, Adviceglobal) - "An absolute pleasure. Exceed expectations. Highly recommended." (Archie Mage) - "He resolved all issues on time and offered to do additional tasks willingly. Very highly recommended." (Ana Heloisa) - "Amazing Talent. Great at communication and will definitely work with him again." (Ricardo Lima) - "Muhammad delivered an exceptional work! Excellent communication, and always making sure that you're happy with the final work. Highly recommended." (Howard Ryan) - "Always great to work with Muhammad. Great communication and knowledge! 100% recommended!" (Sepehr Madani, PrivateLabel, Inc.) - "Muhammad was fast, effective and responsive as always. I highly recommend him." (Tatum MacK) ## Contact Source: https://www.saifcodes.com/contact He reads every message himself and usually replies within a day. - Contact form: https://www.saifcodes.com/contact - Email: hello@saifcodes.com - Schedule a 30-minute meeting: https://calendly.com/ch-saif109/30min - WhatsApp: https://wa.me/923137107887 - Upwork: https://www.upwork.com/freelancers/~01dc46728553f3bae5 - StackOverflow: https://stackoverflow.com/users/msaifmumtaz - LinkedIn: https://www.linkedin.com/in/msaifmumtaz/ - GitHub: https://github.com/msaifmumtaz - Twitter/X: https://twitter.com/msaifmumtaz ## Legal - Privacy Policy: https://www.saifcodes.com/privacy