PatchPlaneOpen control plane

Sleep through
the next drop.

The next critical AI vulnerability shouldn’t cost you a night’s sleep. We’re building PatchPlane to automatically generate remediations and hotfixes, apply them where needed, and let you follow your normal patch cycle.

See it runningGet your night back

No war rooms needed.

One continuous workloadMechanism schematic
A change window on a continuous signalSchematic of ongoing workload traffic while a scoped change is verified and applied, followed by an execution receipt. This is an illustrative mechanism, not live telemetry.RUNTIME HANDOVERWORKLOADThe signal stays on.OBSERVEVERIFYCHANGERECEIPT
A new runtime. An orderly handover.

Canary the verified PHP replacement, send new requests to it, and let the original workers drain.

Process replacement; PHP heap state is not migrated.
Private fleet dashboardSign in to inspect your enrolled systemsInspect the live system

Critical CVEs move fast.
Your patch cycle stays yours.

Our product direction joins automatic remediation generation with signed delivery and local verification. The live demo proves the execution path with three supported CVE recipes.

Generate the remedy.

The goal: turn a new critical CVE into a scoped remediation or hotfix for the affected runtime, library, or kernel. Today’s demo uses three pinned recipes.

Apply it where it’s needed.

Authenticated Rust agents verify signed instructions against current conditions and local policy before applying a supported remedy.

Patch on your schedule.

Temporary protection bridges the gap to permanent updates and any required reboot. Track what’s protected and what still needs work in one control plane.

Three layers.
One live lab.

The reference lab demonstrates three supported recipes in a dedicated VM. Sign in to view current observations from your enrolled agents.

Runtime

PHP2Shell

Guard, canary, promote, drain.

Managed PHP workers · 8.4.26 to 8.4.27
Sign in to viewPrivate fleet evidence
Library

Brotli / HTTP2Shell

A decoder swap at a quiescent boundary.

Cooperative native worker · 1.2.0 to 1.2.1
Sign in to viewPrivate fleet evidence
Kernel

Linux IPv4 TCP

Filter the exposure. Keep the patch on the plan.

Temporary IPv4-options mitigation
Sign in to viewVendor-fixed kernel and reboot still required

Scoped evidence, not universal coverage. The application recipes require managed, pinned components. The kernel filter does not repair the underlying vulnerability.

Wake up to evidence.
Not a war room.

Inspect the signed instruction, the agent’s local checks, and the execution receipt. Current conditions stay separate from past results, so you can see what still belongs on your patch plan.

Read the implemented API
Execution recordAuthenticated access
Authenticated systems
—
Signed jobs completed
—
Automatic policy
Awaiting observation
Last refreshed
Not yet connected

Open any job in the control plane to inspect its evidence.

Keep your patch cycle.
Get your night back.

See automated remediation running in the live lab.

Open the live control plane