Security fixes, installed for you.

When a weakness is found in software you run, Auto-Patching tests the fix on a copy of your setup, installs it in small steps and undoes it on its own if anything breaks.

Start for free Talk to an expert

Security update · OpenSSLRolling out

Servers updated

7/24

3.0.13 → 3.0.15
no restart needed

Tested on a copy
First 10%
Half
Everyone

Pages loading normally Error rate normal Auto-undo on

Careful, so you can stop worrying.

Every update is checked, tested and rolled out with a way back.

Finds what needs fixing

We keep a list of every piece of software you run and check it against new security warnings the moment they are published.

Tests before it installs

Each fix is tried on a copy first, with your own health checks, so a broken update never reaches your customers.

Rolls out in small steps

Updates go to a few servers first, then more, then all. If anything looks wrong, the rollout stops.

Undoes itself if needed

If a server fails its health check after an update, it is put back to how it was, automatically.

Respects your schedule

Choose quiet hours for updates that need a restart. Urgent security fixes can still go out at any time.

Keeps a record

Every change is logged: what was updated, when, why and who approved it.

From warning to fixed, while you sleep.

When a new weakness is announced, we know within minutes which of your servers are affected, test the fix, and update them group by group. Here is what a typical run looks like.

A typical run

9:00A new weakness is announcedA security warning for OpenSSL goes public.
9:02Your affected servers are found7 of your 24 servers run the affected version.
9:05The fix passes its testsInstalled on a copy of one server, health checks green.
9:11Every affected server is patchedUpdated in three groups. Nothing needed rolling back.

You decide what needs a yes.

Small security fixes can go out on their own. Bigger updates, and anything that needs a restart, wait for your approval in Slack, by email or in the dashboard.

Approve or postpone with one tap
Different rules for live and test servers
See exactly what will change before you agree

Updates1 needs you

Linux kernel security update12 servers · needs a restartApproveLater
PHP 8.3.1524 servers · security fix onlyInstalled on its own
WordPress plugin: Elementor 3.21.56 sites · security fix onlyInstalled on its own
nginx 1.27new features, not a security fixYour call

How a fix reaches your servers.

01
Inventory
We list the operating system, packages, plugins and libraries on everything you connect.
02
Match
New security warnings are matched against that list as soon as they are published.
03
Test
The fix is installed on a copy of an affected server and checked with your health checks.
04
Roll out
Servers are updated in small groups. Any that fail their checks are rolled back.

Every step, written down.

You can follow a run in the dashboard or from the command line, and look it up again months later.

patch run · web-01

$ burstlayer patch plan
  openssl       3.0.13 → 3.0.15   security fix
  php8.3-fpm    8.3.4  → 8.3.15   security fix
  nginx         1.24.0            up to date
✓ tested on a copy of web-01, health checks passed
✓ group 1 of 3 updated, no errors

Nothing is installed until it has passed its tests on a copy.

One server or ten thousand, updated one careful step at a time.

Auto-Patching was built for fleets, so it is just as calm with a single website.

Questions, answered.

What people usually ask before they turn on Auto-Patching.

What can Auto-Patching update?+

Operating system packages on Linux and Windows, web servers, PHP, Node.js and Python runtimes, WordPress core and plugins, and container base images.

What if an update breaks my site?+

Updates are tested on a copy first and rolled out in small groups. If a server fails its health check afterwards, it is rolled back automatically and you are told why.

Do my servers need to restart?+

Most security fixes don't. When one does, it waits for the quiet hours you set, unless you choose to apply it right away.

Can I keep some software on an older version?+

Yes. You can exclude packages or servers, or ask to be told about an update instead of having it installed.

Do I need Server Shield for this?+

For servers, yes: Auto-Patching uses the Server Shield agent to install updates. For WordPress, containers and cloud services it works through the connections you have already set up.