Tom

If you're running a PHP website - a critical vulnerability was disclosed before the announced updates tomorrow. If you can't shut down your website and wait for the PHP update, feed your AI this prompt: URGENT: critical PHP security release on 2026-10-21 at 14:00 UTC. Background - The PHP security team pre-announced fixes for two critical vulnerabilities (CVSS v4.0 9.2): php.net/archive/2026.php - Press reports call them remote code execution (CVE-2026-109618, CVE-2026-109619), affecting PHP 5 through 8. Details leaked early. - Affected versions, fixed versions and official workarounds are published only with the release. What to do 1. Inventory Find every PHP install you manage: servers, containers, PHP-FPM pools, Apache mod_php, shared or managed hosting, CLI, and cron jobs. Record the PHP version of each and whether it is reachable from the internet. Work on internet-facing sites first. 2. Interim mitigation (now, before the patch) Check whether the application uses upload progress: search the code for session.upload_progress and PHP_SESSION_UPLOAD_PROGRESS. If it does use upload progress, report how critical that feature is and whether shutting down the website is preferable to disabling only the upload progress feature. Do not change anything until you get an answer. If it doesn't, set session.upload_progress.enabled=Off in php.ini or a conf.d file. Back up each file first, test the config (e.g. php-fpm -t), then reload PHP gracefully. Verify the value as the web server sees it (a phpinfo page or ini_get through the web), not only with php -i. CLI and FPM can read different ini files. Confirm the sites still load. If the config is managed by a deploy tool, config management or a container image, change it there too, or the next deploy undoes it. 3. Patch (after the release) Read the official advisory for affected and fixed versions. Update every affected install: - Containers: pull the patched official image. If the image is pinned by digest or exact tag, update the pin. Rebuild and recreate. - OS packages: apply the security update from your distro or package repository when it is available (it can lag php.net). - Managed or shared hosting: confirm the provider has patched, or select a patched PHP version in the control panel. A new PHP binary needs a full restart of PHP-FPM or Apache (or a container recreate); a reload is not enough. Verify through the web that the fixed version runs and the sites work. 4. Unsupported PHP versions Versions past end of life may get no fix. Upgrade them, or take them off the public internet or put them behind access control, and flag them as high risk. 5. After details are public Check web server and PHP logs since 2026-10-20 for the exploitation signs the advisory describes. Rules - Back up before every change. - Follow your normal approval process for production restarts. - Do not take sites offline without approval. Report for each site - PHP version before and after - Mitigation applied: yes, no, or not applicable - Patch applied: yes or no - Anything you could not do, and why