So Outside Technology Security CMS
AnQiCMS
Online Demonstration

PHP two high-risk vulnerabilities scored 9.2 points, what steps should the site take after the patch is released?

📅 2026-11-01 👁️ 0

Fix for two high-risk vulnerabilities rated 9.2 in PHP was released on October 21, 2026, along with 8.5.12, 8.4.27, 8.3.36, and 8.2.35. After the site upgrades to the new version, it still needs to complete three steps: confirm that the actual running process has been updated to the new version, investigate the high-risk entry points related to vulnerability exploitation, and check that the internal defense configuration within the site is still effective. The patch release is just the starting point of this window.

The three hard facts that can be read from the announcement

The first is scoring and nature. The scores of the two vulnerabilities are both 9.2, belonging to the high-risk segment, which means that the conditions for exploitation are relatively relaxed and the impact is relatively large, and cannot be handled according to the regular vulnerability schedule.The second is the coverage range. The fix enters four supported branches simultaneously, indicating that the affected versions span multiple major versions, and sites still in 8.2 and 8.3 are on the list.The third is the distribution of the fixed version: the 8.5 branch is upgraded to 8.5.12, the 8.4 branch is upgraded to 8.4.27, the 8.3 branch is upgraded to 8.3.36, the 8.2 branch is upgraded to 8.2.35, each branch is patched locally, and no major version change is required for this.

The specific vulnerability number can be found in the announcement and the vulnerability entries of various countries, and only the number should be left as a search clue when discussing publicly, no need to repeat the exploitation details in the site articles.

Verify what first after the upgrade.

The easiest illusion is that 'I have executed the upgrade command, so it is fixed.' The actual running status needs to be verified separately.

Check the version. Confirm in the site environment that the actual effective interpreter version has fallen into one of these four fixed versions. Sometimes, package manager upgrades and panel switches only change the available version, without changing the one being used on the site. Next, look at the processes. Processors running in a resident mode (such as fpm or the corresponding worker processes) need to be restarted to load the new version, and it is common for some processes to remain running on the old version, which is also the most difficult to discover. Finally, look at the regression. After version switching, run the main links such as login, upload, form submission, and observe the error logs to confirm that no new faults have been introduced due to compatibility issues.

Restrict the exposed surface outside the runtime environment

The patch fixes the interpreter, but the actual risk of the site also depends on the upper application and configuration.

Firstly, entry convergence. Check whether the background entry, debugging interface, and unused components can be closed or restricted in access. Most exploits of high-risk vulnerabilities require an accessible entry point, reducing the entry point is to reduce the exploit surface.The second is online verification and data validation. AnQiCMS is built-in with JWT authentication and content sensitive word filtering, anti-capturing interference code, used for defense against SQL injection and XSS attacks;This built-in protection within the station belongs to a layer of defense in depth and cannot replace runtime environment patches, but it can reduce the impact after exploitation when the patches are not applied in time.Three credentials side finishing. AnQiCMS fixed the issue that the login credentials of the site switch could be forged in v3.6.6, and the official recommendation was to rotate the site signature key and change the administrator password at the same time;The principle is universal - once a type of certificate can be forged, after patching, it should be assumed that the old certificate has been exposed.

Regularized action

The frequency of high-risk vulnerability occurrences determines that temporary response is not enough. It is recommended to fix three things: include the supported runtime environment version and its expiration date in the asset list; establish the minimum exercise path from the patch to production, so that the upgrade does not require setting up an environment temporarily; and write the rotation of background passwords and signature keys into the upgrade process, rather than waiting for an incident to occur before addressing it.

Common questions

Question: What if the hosting environment used by the site cannot change versions on its own?Answer: Confirm with the service provider whether these four versions have been applied and request the actual effective time; if unable to confirm, turn off the high-risk features that can be turned off independently first to reduce the exposure during the waiting period.

Question: Can only the command line version be upgraded?Answer: Not enough. The site is provided by a resident process, and the process is still using the old version without restarting, so the Web service must be handled together with all the working processes.

Question: How can you confirm that it hasn't been hacked?Answer: Check for requests with suspicious parameters during abnormal periods in the access log, check for new unfamiliar files and abnormal scheduled tasks, and verify background accounts and login records; handle suspicious signs according to the intrusion response process, isolate first and then collect evidence.

Related articles

How to schedule the upgrade window for the first beta version of Joomla 6.3 at the end of November, while still in the 5.4 site upgrade window

The Joomla official roadmap shows that the first Alpha of version 6.3 is scheduled for November 24, 2026, with the final release planned for April 2027; regular bug fixes for version 5.4 have ceased as of October 13, 2026, with security support ending on October 12, 2027. Sites still running on version 5.4 should prioritize the last year of security support window and complete an upgrade drill with backup and rollback plans before entering the tail end.

2026-11-01

After the AI summary covers most commercial queries, should the content selection change the approach?

There is tracking data showing that the coverage of AI Overview in business intent queries has increased from 45.75% in September 2025 to 88% in August 2026. After the display position is largely occupied by the summary, the selection should shift from wordy pages to question-based content: the title should be written as a question the user would ask, each paragraph should be self-contained as a small answer, and be able to be quoted directly without context; mass production can be facilitated by AI writing and automatic generation of title keyword descriptions.

2026-11-01

More than half of the references in AI answers come from natural ranking, is it still worth making a separate plan for keyword positions?

BrightEdge's continuous tracking of AI Overview references for 16 months shows that the proportion of overlapping pages with natural ranking has increased from 32.3% to 54.5%, with a relative increase of 69%. More than half of the references were originally from the top positions of natural ranking, so the keyword position plan is still a basic investment; GEO is responsible for writing content that can be cited independently, both sides use the same set of content assets, and it is not recommended to transfer the budget from one side to the other as a whole.

2026-11-01

The third-party vulnerability library can list entries by plugin name, should the plugins installed on the site be checked individually?

Public vulnerability library organized by component name and version entries, the premise of site verification is to have a component ledger first. This article provides the minimum information of the ledger, the verification order based on external accessibility priority, and the differences between the two types of disposal actions with official patches and those without official patches, and explains why the system's built-in injection filtering and content audit layer cannot replace this investigation.

2026-11-01

A lightweight blog program can store data within a few tables, how does Typecho control its size?

The official introduction of the Typecho website states that it uses 7 tables and less than 400KB of code to implement a complete plugin and template system, and takes the ultra-low CPU and memory usage as a selling point. The lightness comes from the convergence of data models and the selection of functions. Another route is to change the implementation language: AnQiCMS is developed based on GoLang, and the official data shows that the memory usage is reduced by about 80% compared to PHP CMS, and can carry about 5 million PV on a single machine.

2026-11-01

Webflow e-commerce plan starts at $29 per month, what other projects in the website budget should be listed separately?

At today's comparison page level, the annual payment per month for Webflow's e-commerce standard plan, Wix Core, and Squarespace's basic e-commerce plan is about $29, $29, and $19 respectively. The subscription is just the beginning, and the annual budget for building a website should also include domain and certificate, transaction and collection fees, theme plugins and integration, operation and maintenance backup, and manual maintenance, and calculate the total account by extending the window to five years.

2026-11-01

After Cloudflare splits the AI crawler blocking into three tiers, why might it block Googlebot as well?

There is an observation that Cloudflare categorizes AI crawlers into three types of use: Search, Agent, and Training. Starting from September 15, 2026, intercepting the training category may also affect the crawling of Googlebot, as the same crawler can simultaneously have both search and training purposes. It is recommended to check the rules according to the purpose, compare the crawling logs, and keep a rollback path before enabling interception.

2026-11-01

The number of requests for AI crawlers for search purposes has increased several times within a year, so which columns of the site crawling log should be checked first?

A Q3 2026 report shows that the crawling for search purposes accounts for 8.26% of AI crawler requests, up from 4.05% last quarter and only 1.32% last year. The change in share indicates that more automated traffic is for immediate content retrieval. When troubleshooting site crawling logs, it is recommended to first look at three fields: requestor identifier, frequency per unit time, and return status code, and then decide on robots rules and anti-crawling measures.

2026-11-01