The failure mode in this PHP advisory is not "we upgraded PHP." It is "we upgraded one PHP and left three others running." CVE-2026-109618 and CVE-2026-109619 are in PHP Core, so every branch on the host is its own decision.
Build a table before you patch. Columns that earn their keep: site name, public host, PHP-FPM pool, binary path, version, owner, and status. Status should be one of upgraded, waiting, or cannot upgrade, with a reason in the last case. A shared server that still has an old pool for a forgotten landing page is still exposed.
Do the upgrade in a quiet window. Back up site files, the database, and the pool config first. After the package change, restart PHP or PHP-FPM and prove the new version with the same binary the pool uses, not with a php that happens to be first on a login shell.
Then test the paths that exercise the bugs: home page, login, upload, and a normal form post. Read the PHP error log for a new exception. Walk the process list and confirm no pool is still bound to the old build.
SafeLine does not replace that inventory. The 21 October rule gives you a place to watch suspicious multipart uploads while the list is incomplete. Set the action to blacklist, enable observe mode, and read hits instead of blocking the estate on hour one. The rule page is here.
When the inventory shows a site that cannot move yet, keep that host's rule in observe, restrict who can reach the origin, and do not treat the WAF note as a permanent patch.
How do I know which version a vhost uses?
Read the pool config and the binary that pool executes, not the default CLI PHP.
Can one SafeLine rule cover every old branch?
It can watch the request pattern. It does not upgrade the branch.
What belongs in the "cannot upgrade" note?
The business reason and the compensating control, such as observe mode plus a closed origin.
SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.