2026-11-01
What to check after an emergency PHP update: web PHP vs command-line PHP, set -e and diff exit codes, and an intrusion re-check
During the October 2026 response to the critical PHP vulnerabilities, a site this site's operator runs had updated the web PHP, but the command-line PHP used by cron still pointed to an old version. Check web and CLI separately. With set -e, diff and grep return exit status 1 for 'differences found' or 'no match', which stops the script; handle 0, 1 and 2 separately. After patching, run the same intrusion checklist on every server, and settle a suspicious log entry by comparing live files with the known-good deployed copy.