Security advisory and field notes
Real incidents, response decisions, reusable tools, and reversible remediation.
On October 21, 2026, PHP shipped emergency fixes at 14:00 UTC. This is our end-to-end record: verifying the advisory, checking the Hong Kong production node, upgrading PHP, and building guarded Linux and Windows Server remediation tools.
Updating WordPress, Laravel, or plugins does not fix it. The PHP runtime must be updated.
Old PHP-FPM, Apache, IIS, and container workers can keep executing unpatched code.
The script backs up the PHP installation only. A full-machine snapshot remains the primary rollback.
The scanners perform passive version and configuration inventory. Server remediation scripts default to check-only and require three confirmations before changes.
An HTTP scan cannot see a hidden version. “Unknown” must never be treated as “safe”.
