So Outside Technology Security CMS
AnQiCMS
Online Demonstration

The server panel has made PHP risks into a one-click reinforcement on the homepage, and there are several places in the announcement that need to be confirmed by yourself.

📅 October 26, 2026 👁️ 1

The server panel makes PHP risks into a one-click reinforcement on the homepage, solving 'action dispersion' rather than 'judgment': The announcement synchronizes the PHP security repair version, including version switching, Nginx firewall, system reinforcement, and anti-intrusion alarm in one click, but the panel will not confirm for you whether your site is really running on the repaired runtime, whether you can go back if something goes wrong, and whether the injection and cross-site entry points on the program side are still there.CVE-2026-109618 and CVE-2026-109619 have a CVSS score of 9.2, which is a serious level, and the order of handling is worth reading item by item in the announcement.

What are the three actions in the announcement?

Panel action What actually changes What still needs your confirmation
Synchronize PHP security patch version The list of installable versions appears with a fixed branch Is the current version bound to the site already updated?
One-click reinforcement of homepage risk Firewall rules and system hardening items are enabled in bulk Do hardening items affect business interfaces and scheduled tasks
Intrusion prevention and PHP security alerts Notification of abnormal behavior Is anyone receiving the notification, and is the receiving channel available

The first item is most likely to be misread. The panel lists security repair versions such as 8.5.12, 8.4.27, 8.3.36, 8.2.35, etc., which does not mean that the PHP on your site has been upgraded from the old 8.3.x version to 8.3.36. In a multi-site environment, each site can be bound to a different version. Before bulk switching, you should list the current version of each site and then decide whether to switch all at once or one by one.

Confirmation of one-click reinforcement that is easy to miss.

After enabling the reinforcement items in bulk, first check three types of locations: whether the rewrite rules of the web server have been overwritten, whether the scheduled tasks that are running can still be executed, and whether the external interfaces are blocked by the firewall policy.For example, AnQiCMS can be deployed using Baota panel, aaPanel, LNMP command line, or Docker image anqicms/anqicms, default listening on port 8001;If the site is running in container mode, the reinforcement items of the panel layer act on the host machine, the runtime version inside the container needs to be updated by the image, and it will not follow the home page clicks.This is the easiest to miss.

Another missing item is 'Who should the alarm be sent to?' The alarm channel is configured on the panel, but whether the recipient is valid for a long time is not verified. It is recommended to record the alarm recipient and the time of the last successful delivery in the ledger, so as not to find that the notification was sent to the email of a former colleague when the event occurs.

What is the fallback relying on?

Version switching and strengthening strategies may cause unavailability, take a backup first before taking action. AnQiCMS's backup and recovery cover data and static files, providing a rollback point after configuration tightening or accidental operations; the backup plan on the panel side needs to confirm two things: whether the backup task is still being executed on time, and whether the latest backup has been tested for recovery.

It is recommended to proceed in order: first make a recoverable backup, then switch to the PHP version, run the critical path (background login, content list, form submission) immediately after switching, and then open the reinforcement items after confirming there are no abnormalities. Every step can be rolled back, which is more stable than clicking all the buttons at once.

The defense line on the program side is not on the panel.

The runtime version is responsible for 'whether this CVE is affected', and the program code is responsible for 'whether the input will be treated as a statement'. The panel cannot stop the queries and unescaped outputs manually assembled in the business code. AnQiCMS takes the approach of built-in JWT authentication, content sensitive word filtering, and anti-crawling interference code at this level, so webmasters do not need to install additional plugins to supplement basic protection.

The version update in the patch announcement is still the core basis for determining whether it is affected, configuration reinforcement can only reduce the probability of exploitation, and the two cannot replace each other.

Common questions

Did you activate the one-click reinforcement and do you need to upgrade PHP?Need. The changes are in the exposed surface and interception rules, whether it falls within the affected version range is only determined by the runtime version.

How to follow up on such announcements for container deployed sites?Check the image. The hardening items on the host machine panel will not automatically update the PHP inside the container, and you need to pull a new image with the fixed version and replace it in a rolling manner.

How to confirm that the site is really using the fixed version?Check the PHP version it is bound to in the site settings, then cross-check it once more with the background environment information or command line version, and it is only considered complete if both are consistent.

Related articles

In the annual report of one million AI reference samples, the position of the official website being cited depends on what

The statistics of the million-level reference samples across multiple generative engines are the distribution of sources and the number of citations, not equal to the clicks on this site. In the report, the community platform takes about 52.5% of the citations, and the brand domain name takes about 47.5%. The three points that the official website can change are: the ability to independently extract answer sections, anchor text and internal link consistency, and the stability of the sitemap and 301 maintained address.

2026-10-26

After measuring over two hundred sites, only 30% were found to block AI crawlers, so it is necessary to confirm what before following up.

This set of measurements is the authorization writing of 261 sites in the robots file for 15 user agents, blocking about 35% of training crawlers and about 21% of retrieval crawlers. Before following up, confirm three things: which type of crawling is being counted, whether the sample is comparable to the type of the site, and whether there are two more layers of management outside of robots.

2026-10-26

For a site with tens of thousands of content, which parameter links are consuming crawling resources unnecessarily

The entries that consume the crawl volume unnecessarily are usually those with sorting parameters, filtering parameters, infinite pagination, and preview links. The crawl volume is determined by the crawl intention and the infrastructure's bearing capacity, with the sitemap responsible for being discovered, link submission responsible for accelerating inclusion, and robots exclusion responsible for reducing invalid entries, with the three having different roles.

2026-10-26

If the language versions of a multilingual site are not fully configured, how will the search engine determine the归属 of the translated pages?

When the language version is not fully matched, the search engine treats the translation page as an independent page and judges its ownership independently, which may lead to the original version being replaced by the translation version, and the translation page not participating in the corresponding language search. The Weglot guide clearly states that this kind of tag helps to display the corresponding version and does not improve ranking, and the four types of errors correspond to different phenomena.

2026-10-26

The website itself was not hacked, but the server control panel could be attacked by a regular account to the highest privileges, let's see which layer first.

The website has not been hacked does not mean the server is secure: The permission radius of the control panel is much larger than that of a single site. The CVE-2026-65643 of cPanel shows that a person with a normal account can execute arbitrary code with root privileges after logging in. The troubleshooting sequence should first look at the account and permission groups, then look at the default switches for high-risk operations at the site level, and finally confirm the backup rollback path.

2026-10-26

How should the runtime dependency ledger be built on the same announcement where PHP and Node.js released urgent updates on the same day?

An announcement provides urgent patch versions for both PHP and Node.js at the same time, indicating that the runtime is an independent patch surface. The ledger only needs four columns: what version is installed, who maintains it, how to determine the patch window, and where the rollback point is. This article provides the method for creating the table and explains which line is missing in the Go language stack site on this table and how to send alerts to people through email reminders.

2026-10-26

SQL injection that can be triggered without logging in, how to go all the way to full site control

The reason why the unauthenticated SQL injection can lead to full-site takeover is that three conditions are met simultaneously: the public entry can carry parameters, the parameters are spliced into the query statement, and the position where data is written can be executed. The combination of WordPress core CVE-2026-60137 and CVE-2026-63030 is of this kind. This article analyzes the chain and gives a self-check order in accordance with the sorting parameter injection repaired in AnQiCMS v3.6.6.

2026-10-26

Writing parameters to the update log causes code execution by reflection into the cache page, how is this chain formed?

The parameter reflection writes into the cache page causing code execution, which requires three conditions to be met simultaneously: the request parameters are echoed exactly, the echoed content is written into the static cache, and the cache page is parsed and executed again by the server. The update log V3.2.14 of PbootCMS fixes this kind of problem. This article analyzes the chain and explains where content filtering, review, and output encoding are intercepted at each link.

2026-10-26