Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Operations · data as of 24 October 2026, 16:05 UTC
What changed, what to do next, and how sure we are
Internet-facing mod_php first, then FPM, then everything else. Where patching slips, apply php.net's temporary settings and record that each blocks a known path only. Alert on PHP workers spawning shells or fetching tools. Decide now who calls isolate or offline, and when.
Your next three actions
The whole playbookPatch internet-facing first
mod_php, then FPM, then the rest. Restart every worker; rebuild every image; check the running version after the restart.
Bound the known paths
session.upload_progress off, low post_max_size, fatal_error_backtraces off on 8.5, pm.max_requests on FPM. Each blocks a path; none is a fix.
Watch the process tree
Alert on a PHP worker spawning a shell or a downloader. A clean access log proves nothing about the host.
What changed, newest first
Release by releaseMark an item read with its circle: it fades, and leaves when you choose to hide read items. It comes back only if what it says changes.