Context: PHP's emergency release lands Oct 21 at 14:00 UTC. CERT-EU advisory 2026-018 says no technical details are public and recommends identifying PHP apps, patching as soon as fixes ship, and isolating internet-facing apps where you can't. Huntress says it has seen no in-the-wild exploitation and is not aware of public exploit code as of its post.

Hunt ideas (from Huntress):

• Parent process php-fpm, php-cgi, php-cgi.exe, httpd or apache2 spawning sh, bash, cmd.exe, powershell.exe, python, perl, curl, wget, nc or certutil.exe.
• Command lines from the web server containing /dev/tcp/, fsockopen or mkfifo, and quick recon like whoami, id, uname -a, ipconfig.
• New PHP files in web roots or temp dirs, new cron jobs, scheduled tasks or accounts on PHP hosts.
• On Linux web servers with no EDR, Huntress suggests Florian Roth's free process-watcher in observe mode to get this visibility before the patch.

Capture a baseline tonight of normal PHP child processes so post-release exploitation stands out.

Unconfirmed workaround (community, not PHP): some researchers on X suggest setting session.upload_progress.enabled = Off as a pre-patch mitigation. PHP, CERT-EU and Huntress have not confirmed the affected component, so treat this as a low-risk hardening guess, not a fix, and still patch.