Treat the public advisory as the start of a change window, not as a research project. CISA’s 21 October 2026 alert asked organizations to inventory PHP, patch internet-facing systems first, and take unpatchable PHP 8.1-and-older systems offline until they can be updated.
List every place PHP answers HTTP: hosts, containers, panels, and serverless or PaaS stacks. For each, record the SAPI and the package or image. Patch the ones with a known fixed package the same day. For the rest, apply PHP’s temporary settings if you can restart workers, and remove them from the internet if the data justifies it.
Do not spend the first day writing exploit tests. Do not trust a WAF signature as the close. Assign an owner for the restart, because the package install without a worker recycle is an unfinished change.
End the day with a list of what is verified patched, what is contained, and what is still unknown. Unknown rows are the consulting queue, especially legacy 5.6 and 7.x.