Tip: after the PHP emergency update, prove the new build is the one serving traffic, and only use PHP's stopgaps where you truly can't patch yet

how-to (from PHP's Oct 21 advisory)2026-10-21

Check what's live, not what's installed. php -v only shows the CLI. Restart every FPM pool, Apache with mod_php, FrankenPHP/LiteSpeed and long-running workers (Octane, queue, Swoole), then hit a protected phpinfo or version endpoint on each pool and look for 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your distro's patched package version.
Distro packages: vendors got the fix early, so compare the package changelog for CVE-2026-109618/109619 rather than the upstream version string.
Containers: rebuild from updated php: base images and redeploy; a running container doesn't change when the tag does.
Can't patch today? PHP's partial measures, set where apps can't override them (php.ini, FPM pool php_admin_value, server config, not ini_set() or .user.ini): memory_limit=-1, post_max_size 8M (32M if uploads are needed) with upload_max_filesize below it, session.upload_progress.enabled=0, and on 8.5 fatal_error_backtraces=0, then restart every worker. Pair with a container or cgroup memory limit, but PHP warns not to use RLIMIT_AS/RLIMIT_DATA. Hiding errors with display_errors or @ does not help. These narrow known paths only; they don't make PHP safe.