If you're on PHP 8.1 or older, there is no official fix coming. Those branches are end-of-life. Your options are: upgrade, or ask your hosting/distro vendor if they provide a backported patch (some LTS vendors do).
What to actually do today
1. Check what's really running your site, not just your CLI version
php -v
This shows your CLI version. It is not necessarily the version serving requests. Check the SAPI that's actually live:
php-fpm -v
curl -sI https://yoursite.com/ | grep -iE "^(server|x-powered-by):"
CLI and web versions can differ, especially on servers hosting multiple projects.
2. Patch internet-facing systems first
If it's reachable from the open internet, it's the priority. Internal-only services can wait a few hours if you're triaging a lot of infrastructure.
3. Don't forget bundled PHP
Docker base images, CMS installer bundles, and vendor tarballs often ship their own PHP. A host-level patch won't touch these. Check every running image:
docker exec <container> php -v
4. Ask your hosting provider directly
Managed hosts (SiteGround, Cloudflare-fronted setups, etc.) may have already deployed WAF-level mitigations or patched server-side. Don't assume — ask.
5. Watch for post-exploitation signs
Keep an eye on PHP worker processes spawning shells, curl/wget calls, or unexpected outbound connections. That's the pattern seen in active exploitation so far.
A stopgap, not a fix
Some researchers have floated disabling session.upload_progress as a temporary mitigation:
session.upload_progress.enabled = Off
This is not a substitute for patching. Treat it as something you do while you're rolling out the real fix, not instead of it.
If you manage sites for other people
Send a short, plain update today — what happened, what you're doing about it, when it'll be done. Clients hearing about a "PHP vulnerability" from the news before they hear it from you is a worse conversation than this one.
Sources:
Has your stack been patched yet? Drop your setup in the comments — curious how many people are finding PHP buried in places they forgot about.
