Drupal security updates don't cover this PHP flaw.
The new PHP vulnerabilities sit below Drupal core, in the PHP runtime. Being current on Drupal security releases doesn't protect you. The PHP version on the server decides whether you're exposed.
Is the PHP Drupal runs on affected?
Run php -v on the server. A patched version on disk only protects you after every PHP worker restarts. Distro packages can carry backported fixes under older version numbers, so we confirm against your vendor's changelog.
What makes these sites a target.
Drupal 7 sites run on old PHP
Drupal 7 reached end of life in January 2025, and many of those sites still run PHP versions that won't be patched.
Modern Drupal brings its own PHP floor
Drupal 10 needs PHP 8.1 or newer, and 8.1 gets no fix. Drupal 11 requires 8.3, so it only needs a patch release.
Webforms and file fields take posts
Public forms, file uploads and REST endpoints accept the kinds of requests these exploits use.
Many servers, many PHP pools
Multisite installs and load-balanced web heads each run their own PHP workers, and every one needs patching and a restart.
How we fix it on Drupal.
The first commands we run, read-only:
drush status # Drupal and PHP versions
php -v
systemctl list-units --type=service | grep -Ei 'php|httpd|apache2|nginx'Inventory
We record the Drupal core version, PHP version and contributed modules on each environment with Drush.
Plan the path
Drupal 10 and 11 sites move to a patched PHP release. For Drupal 7 we decide with you between a migration and a supported PHP upgrade.
Upgrade and restart
We update PHP on every web head, rebuild containers where you use them, and restart all PHP-FPM pools.
Harden and verify
We lock down php.ini, add edge rules around your real form and upload routes, and confirm the patch on each server.
Any cloud, any VPS, any server.
The fix is the same everywhere: a patched PHP build, restarted workers and hardened settings. We work on VMs, containers, Kubernetes, serverless runtimes and control-panel hosting.
Pick how much you want us to do.
Exposure check
- Every PHP version and server you run, listed
- Clear verdict: exposed or not, and how urgent
- Written report with next steps
Fixed fee, credited toward remediation
Guided remediation
- Upgrade plan for your platform and hosting
- Temporary hardening while you wait
- Edge and WAF rules written for your routes
- We review your team's work and verify it
Hourly or fixed package
Full repair and upgrade
- Staging test, upgrade and rollback plan
- Patched PHP on every server and container
- All workers restarted and verified
- Hardening, monitoring and a closing report
Fixed quote per environment
Patch watch
- We track PHP and platform advisories
- Quarterly version and config checks
- Priority response for the next critical CVE
Monthly retainer
From first call to verified fix.
Authorize
You sign a short scope and authorization. We don't scan or touch any system without it.
Inventory
We record every PHP version, server, container and worker process in scope.
Plan
You get a fixed quote, a schedule and a rollback plan before any change.
Patch and restart
We upgrade PHP and restart every worker so no vulnerable code stays in memory.
Verify
We confirm the fix on every host and hand over a written report.
Don't restart the server yet.
If you see shells or tools like curl launched by PHP processes, PHPSESSID cookies longer than 256 bytes, or a spike in PHP worker crashes, contact us before you patch. Restarting wipes the memory evidence that shows what an attacker did. We preserve that evidence first, then work with an incident response firm if the investigation needs one.
Drupal questions.
We're on Drupal 7. Is there any quick fix?
Temporary hardening and WAF rules lower the risk, but they don't remove it. A real fix means a patched PHP 8.2+ release, so we'll scope the compatibility work.
We host on Acquia or Pantheon. Are we covered?
Platform hosts usually patch PHP for you. We can confirm the version your environments report and review any custom servers outside the platform.
Can you work with our internal team?
Yes. Our consulting tier gives your developers a written plan and supports them through the change.
Find out where you stand this week.
Tell us what you run on Drupal and where it's hosted. We'll reply within one business day with a time for the exposure check.
Include your platform, approximate number of sites or servers, and your hosting provider.