---
title: Tip: get ready for tomorrow's PHP emergency fix tonight: find every PHP runtime, image and appliance, and pre-stage the rebuild | ctxsec
url: https://ctxsec.com/items/tip-prep-php-emergency-release-oct-21
description: ""
status: "how-to (ahead of PHP's Oct 21 14:00 UTC release)"
published: 2026-10-20
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-prep-php-emergency-release-oct-21.md)

how-to (ahead of PHP's Oct 21 14:00 UTC release)

2026-10-20

### Tip: get ready for tomorrow's PHP emergency fix tonight: find every PHP runtime, image and appliance, and pre-stage the rebuild

PHP's fix for two critical bugs lands **Oct 21 at 14:00 UTC** ([details](/news#php-critical-security-release-oct-21-leaked-rce)). Details have already leaked, so the gap between patch and exploit may be short. Tonight:

1. **Find it everywhere.** On hosts: `php -v` and `php -i | grep -i 'Server API'`, plus `ls /etc/php* /opt/*/php* 2>/dev/null`; for packages, `dpkg -l 'php*'` or `rpm -qa 'php*'`. In containers, search Dockerfiles for `FROM php:` and scan running images with your SBOM tool (for example `syft <image> | grep -i php`).
2. **Don't forget the hidden ones:** WordPress, Drupal, Magento and Laravel hosts, vendor appliances with a PHP web UI, CI runners, and shared-hosting or managed-platform accounts where the provider patches for you (check their status page).
3. **Pre-stage the update.** Know which repo you pull from (distro, Ondřej Surý PPA, Remi, official Docker images) and whether it usually ships same day. Distro backports can lag the upstream release.
4. **Shrink exposure until then:** put internet-facing PHP apps behind your WAF, take test, staging and abandoned PHP sites offline, and isolate PHP 5/7 hosts that won't get fixes.
5. **After patching,** restart PHP-FPM or Apache so the new binary is actually loaded, and confirm with `php -v` and a phpinfo check on the live pool.

Sources: [php.net: Upcoming Critical PHP Security Release](https://www.php.net/archive/2026.php#2026-10-20-1) · [watchTowr on X (Oct 20)](https://x.com/watchtowrcyber/status/2112611507749982605)