PHP Vulnerability Responses by Company

Alibaba Cloud

Global cloud / infrastructure
Aliases / services
アリババクラウド / 阿里云 / Aliyun / Alibaba Cloud
Official website
https://www.alibabacloud.com/

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

Alibaba Cloud Linux

Response status
Fixed packages available
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Provides computing infrastructure, databases, and security services.

Official packages and procedures address both CVEs on Alibaba Cloud Linux 2, 3, 4 and 4 Deb Edition.

Scope: Linux 2 requires the applicable subscription setup. These are customer-environment fixes, not a completion claim for all cloud services.

What users should do

Apply the OS-specific fix, restart and verify the PHP workers serving web requests, and separately update container or custom-installed PHP.

Official service URL

Source URLs

  1. https://help.aliyun.com/en/alinux/product-overview/cve-2026-109618-cve-2026-109619-vulnerability-remediation-instructionshttps://help.aliyun.com/en/alinux/product-overview/cve-2026-109618-cve-2026-109619-vulnerability-remediation-instructionsResponse evidence
  2. https://www.alibabacloud.com/blog/critical-remote-code-execution-vulnerabilities-disclosed-in-php-alibaba-cloud%E2%80%99s-quick-protection-guide_603655https://www.alibabacloud.com/blog/critical-remote-code-execution-vulnerabilities-disclosed-in-php-alibaba-cloud%E2%80%99s-quick-protection-guide_603655Service and operation documentation

Security Center

Response status
Inventory and investigation guidance
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

The guide describes PHP inventory and host-risk checks.

Scope: Incident guidance; not confirmation of PHP patching or completion across customer environments.

What users should do

Check the PHP runtime handling web requests and its patches.

Source URLs

  1. https://www.alibabacloud.com/blog/critical-remote-code-execution-vulnerabilities-disclosed-in-php-alibaba-cloud%E2%80%99s-quick-protection-guide_603655https://www.alibabacloud.com/blog/critical-remote-code-execution-vulnerabilities-disclosed-in-php-alibaba-cloud%E2%80%99s-quick-protection-guide_603655Response evidence

Web Application Firewall 3.0

Response status
Protection configuration guidance
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

The guide covers protected domains, traffic routing and WAF rules.

Scope: Incident guidance; not confirmation of PHP patching or completion across customer environments.

What users should do

Verify coverage and rule actions; patch PHP too.

Source URLs

  1. https://www.alibabacloud.com/blog/critical-remote-code-execution-vulnerabilities-disclosed-in-php-alibaba-cloud%E2%80%99s-quick-protection-guide_603655https://www.alibabacloud.com/blog/critical-remote-code-execution-vulnerabilities-disclosed-in-php-alibaba-cloud%E2%80%99s-quick-protection-guide_603655Response evidence

Cloud Firewall

Response status
IPS and access-control guidance
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

The guide recommends reviewing IPS mode and access controls.

Scope: Incident guidance; not confirmation of PHP patching or completion across customer environments.

What users should do

Monitor mode does not block. Assess changes and patch PHP.

Source URLs

  1. https://www.alibabacloud.com/blog/critical-remote-code-execution-vulnerabilities-disclosed-in-php-alibaba-cloud%E2%80%99s-quick-protection-guide_603655https://www.alibabacloud.com/blog/critical-remote-code-execution-vulnerabilities-disclosed-in-php-alibaba-cloud%E2%80%99s-quick-protection-guide_603655Response evidence

Managed Security Service

Response status
Contract-scoped response assistance
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Purchased service scopes may include assessment and recovery help.

Scope: Incident guidance; not confirmation of PHP patching or completion across customer environments.

What users should do

Confirm the required work with your service team.

Source URLs

  1. https://www.alibabacloud.com/blog/critical-remote-code-execution-vulnerabilities-disclosed-in-php-alibaba-cloud%E2%80%99s-quick-protection-guide_603655https://www.alibabacloud.com/blog/critical-remote-code-execution-vulnerabilities-disclosed-in-php-alibaba-cloud%E2%80%99s-quick-protection-guide_603655Response evidence
Related official sources
  1. Alibaba Cloud Vulnerability DBOfficial information directory
  2. Alibaba Cloud DocumentationOfficial information directory

Comments