The CVE-2026-109619 advisory suggests an isolated audit with log_errors on, a working error_log, and error_reporting set to E_ALL in startup configuration. Look for warnings before the target script runs, diagnostics during extension shutdown, fatal and parse errors, maximum execution time messages, and failures on routes an attacker can influence.
PHP is explicit that a quiet log is not proof of safety. Historical logs may have dropped deprecations. A failure can happen before the message is written. Logs supplement a configuration review.
CISA’s alert also says to monitor for suspicious activity, including PHP workers launching shells or downloading tools. That is general incident response. This site does not provide a detection signature or a list of exploit strings. If you see a worker spawning a shell, involve your incident process and preserve the host. Do not wipe it to “clean up” before you know the runtime is patched.
During the patch itself, the useful log lines are failure to start, inability to bind the socket, and PHP modules that failed to load. Those mean the new build is not serving traffic cleanly.