# PHP Security

<!-- meta: type=php-security; location=Security; category=Step (action); platforms=Joomla and WordPress -->

## Overview

Reads the PHP version running on a linked Joomla or WordPress site and reports whether that runtime includes the fixes for known vulnerabilities. Put it on a JOrchestrator cron so the check repeats.

When the flow reaches this step, JOrchestrator executes **PHP Security** against your linked site or an external integration, using the field values you set on **General** and **Design**. Downstream steps can read the output payload fields defined for this node.

## Why use this node

PHP Security is a **action step** in the **Security** group. Action steps run in the middle or end of a flow. They perform work on your CMS, call external services, or transform data for the next step.

Typical reasons teams add **PHP Security** to a flow:

- Check the PHP runtime on every linked site from a JOrchestrator cron
- Flag installs missing a known fix, including the 21 October 2026 releases
- Hand patched, needs-patch, or unsupported to email, Slack, or the next step

## When it runs

This step runs when the flow reaches it. On a JOrchestrator cron it repeats. It asks the linked site for the PHP version it is running and compares that version with the releases that fix known vulnerabilities. The releases it is checking now are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, published on 21 October 2026.

## Example workflows

Common patterns on the canvas:

1. **Jorchestrator Cron** → **PHP Security** → **Send Notification** → **Slack Message**
2. **Webhook** → **PHP Security** → **Slack Message** (while testing) → production action

## How to set it up

Link the flow to a domain. On the Design tab, turn on Fail when unpatched if this step should stop when the site is still exposed. Leave it off to always continue and let a later condition read the status field.

## Good to know

Those releases address CVE-2026-109618 and CVE-2026-109619. The same check covers later advisories as they are published. PHP 8.1 and older are reported as unsupported because the PHP project no longer ships fixes for them. This step reports status. It does not change PHP on the server. Patch the host, then let the cron run again.

## Properties panel

The designer shows these tabs for this node:

| Tab | Purpose |
|-----|---------|
| **Info** | Plain-language description and output payload fields for downstream steps |
| **General** | Canvas label and read-only node ID |
| **Design** | Whether an unpatched or unsupported site should stop this step |

### System (automatic — not edited by the user)

These fields are managed by the designer or runtime — you do not type into them directly:

| Property key | Label | Type | Required | Visible when | Notes |
|--------------|-------|------|----------|--------------|-------|
| `_nodeId` | Node ID | `node-id` | No | — | — |
| `_payloadFields` | Available Fields | `payload-panel` | No | — | — |

### User-configured — General tab

| Property key | Label | Type | Required | Visible when | Notes |
|--------------|-------|------|----------|--------------|-------|
| `label` | Label | `text` | No | — | Node label |

### User-configured — Design tab

| Property key | Label | Type | Required | Visible when | Notes |
|--------------|-------|------|----------|--------------|-------|
| `failOnUnpatched` | Fail when unpatched | `checkbox` (default: off) | No | — | Stop this step when the linked site is below a fixed release or on an unsupported PHP line. |

### CMS site configuration (not on this node's properties panel)

Credentials, API keys, mailers, SMTP, and integration defaults are configured in the CMS plugin under **Node Configuration**, not per step on this node. Link the flow to a domain before testing CMS-backed fields.

## Output payload fields

After this step runs, later nodes can reference these fields using placeholders such as
`{{php_security.phpVersion}}`.

| Field key | Type | Description |
|-----------|------|-------------|
| `success` | boolean | Whether the linked site reported its PHP version. |
| `phpVersion` | string | Version string reported by the site, such as 8.3.36. |
| `sapi` | string | How PHP is serving the site, such as fpm-fcgi or apache2handler. |
| `status` | string | patched, needs-patch, or unsupported. |
| `patched` | boolean | True when the reported version includes the fixes for the advisories this step checks. |
| `recommendedVersion` | string | Lowest fixed release on the same supported line, when one exists. |
| `advisories` | array | CVE ids the running version does not include fixes for. Empty when patched. |
| `message` | string | Short status sentence for a later email or chat step. |