PHP: the work behind “we’ve patched it”

The PHP vulnerabilities disclosed in October 2026 are a useful reminder of how much work sits behind a short sentence: “We’ve patched it.”

Someone has to find the affected applications. Someone has to contact the hosting provider. Someone has to test the change, approve the interruption and check that the service still works afterwards.

The PHP team released fixes for two critical vulnerabilities on 21 October 2026. For organisations reviewing their response, the useful question now is whether they can show which systems were updated—and who checked.

At INCA, our view is that preparation should make this work easier for the people doing it. Clear ownership, a usable inventory and an agreed route for emergency changes give teams a better starting point when the next advisory arrives.

A worthwhile exercise this week: ask a colleague to walk through how an urgent patch reaches production. Pay attention to the steps that depend on one person knowing whom to call.