PHPFixes guides
For people responsible for PHP websites and servers. Follow the security update response, find out which PHP serves your site, and compare options for an older application.
The PHP project's October 20 warning was followed by four branch releases on October 21. PHP 8.2 users also face a December end to upstream security support.
Read the release reportDistribution notices and package trackers identify their own fixed builds. Older releases also require attention to the maintenance service covering the package.
Read the distribution reportThe October 22 update records separate control-panel releases from PHP packages supplied through different channels. Hosting teams need to confirm the runtime assigned to each site.
Read the hosting reportRead the advisory, identify the relevant package and runtime, and check the running service. Learn what a version number, installed update and process check can each establish.
Read the PHP2Shell guideUnderstand backported fixes, compare the full distribution package build, and distinguish command-line PHP from PHP-FPM or Apache. Investigate workers that may still be using a replaced file.
Read the backports guideCompare an application upgrade with precisely covered vendor support and short-term exposure controls. See how support scope, compatibility, cost and recovery affect the decision.
Read the older-PHP guide