patches landed today at 14:00 utc. php.net says every php install serving web requests is affected (fpm, mod_php, php-cgi, frankenphp, litespeed). mod_php is the worst case because it can be hit before any app code runs.
easy to miss:
- docker: updating php on the host does nothing for your containers. pull or rebuild the image and check with docker exec <container> php -v
- make sure php-fpm really restarted after the update, old workers keep the old code
- 8.1 and older get nothing upstream. distro or lts backports, or the PHP-8.1-CVE-2026-109618-109619 branch in php-src if you build yourself
- remi repo has no update today (php.net says it), use distro packages or build from source
- outside check: curl -sI https://yoursite | grep -i x-powered-by. a lot of sites still send the php version even behind cloudflare. found one of mine this way
if you cant update right now (php.net: this reduces risk, it is not a fix):
- session.upload_progress.enabled=0 in php.ini or the fpm pool, then restart all workers. ini_set or .user.ini does not count
- memory_limit=-1 via php_admin_value, plus a low post_max_size (8M, or 32M if you need uploads)
- on 8.5 also fatal_error_backtraces=0
cloudflare says its waf blocks known payloads by default since 03:02 utc, free plan too. but they also say attackers already mutate the payload, so dont treat it as the fix.
sources: php.net/archive/2026.php and blog.cloudflare.com/php-vulnerabilities-waf-protection