What CloudLinux (alt-php) says
CloudLinux blog (21 Oct 2026, interim) and status-page incident timeline (UTC, Oct 20 to 21) say alt-php builds for 5.2 to 8.5 are being prepared after upstream release. Per the timeline, only alt-php74 (EL6, EL7, EL8, EL10, Debian 10/11, Ubuntu 16.04/18.04/22.04/24.04/26.04) and alt-php80 (Alpine 3.23) were listed as shipped; the page does not confirm other alt-php builds or that ea-php has shipped (ea-php is scheduled for EasyApache4 v25.91). Imunify360 WAF ruleset 8.83 is an interim mitigation only.
an interim mitigation, not a complete fixUpdating PHP is still action number one.Update PHP
Blog: alt-php: yum update 'alt-php*'; Debian/Ubuntu: apt-get upgrade. Status page: 'yum update / apt upgrade'. For cPanel ea-php see the cPanel entry. Imunify360 ruleset check (cPanel with Apache): cat /etc/apache2/conf.d/modsec_vendor_configs/imunify360-full-apache/VERSION; if older than 8.83: imunify360-agent update --force modsec-rules.
Restart PHP
Status page says to restart Apache, PHP-FPM or LSAPI after updating; no exact commands given by CloudLinux in the pages read.