{"id":5764,"date":"2026-10-21T11:12:47","date_gmt":"2026-10-21T15:12:47","guid":{"rendered":"https:\/\/underhost.com\/blog\/?p=5764"},"modified":"2026-10-21T12:51:16","modified_gmt":"2026-10-21T16:51:16","slug":"php-security-release-october-2026-patch-guide","status":"publish","type":"post","link":"https:\/\/underhost.com\/blog\/php-security-release-october-2026-patch-guide\/","title":{"rendered":"PHP Critical Security Update (October 2026): Patch Guide, CERT-EU Advice and Mitigations"},"content":{"rendered":"<div style=\"background:#FFF7ED;border:1px solid #FDBA74;border-radius:14px;padding:16px 20px;margin:0 0 24px;color:#7C2D12;\"><strong>Updated 21 October 2026.<\/strong> This guide follows CERT-EU security advisory 2026-018 and the PHP project release of 21 October 2026. Update to a fixed release first. If you cannot update straight away, the temporary mitigations below reduce exposure, but they do not fix the problem.<\/div>\n<h2>Short answer<\/h2>\n<p>Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, can allow <strong>unauthenticated remote code execution<\/strong>. Both carry a CVSS v4.0 score of 9.2. The PHP project released fixes on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. CERT-EU advises organisations to patch immediately, and to isolate internet-facing applications where patching is not yet possible.<\/p>\n<h2>What the advisory says<\/h2>\n<ul>\n<li>On 20 October 2026, the PHP project announced an upcoming security release for two critical vulnerabilities.<\/li>\n<li>The fixes were released on 21 October 2026, in the four branches listed in the table below.<\/li>\n<li>Technical details are now being discussed publicly, and initial proofs of concept have begun to circulate. CERT-EU says this raises the likelihood that attackers are already exploiting the vulnerabilities.<\/li>\n<\/ul>\n<h2>Who is at risk<\/h2>\n<p>Every PHP installation that serves web requests is at risk. That includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP project considers mod_php the highest-risk setup, because a demonstrated exploit can trigger the attack with one unauthenticated request, before any application code runs.<\/p>\n<p>Many commercial and open-source products use PHP internally, so they can be affected even if they do not show a PHP installation. CERT-EU recommends checking the NCSC-NL repository for third-party software that embeds PHP.<\/p>\n<h2>Affected versions and fixed releases<\/h2>\n<table style=\"width:100%;border-collapse:collapse;margin:0 0 24px;\">\n<thead>\n<tr style=\"background:#0D1F3C;color:#fff;\">\n<th style=\"padding:10px;text-align:left;\">PHP branch<\/th>\n<th style=\"padding:10px;text-align:left;\">Affected before<\/th>\n<th style=\"padding:10px;text-align:left;\">Fixed in<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"padding:10px;border-top:1px solid #E5E7EB;\">8.5<\/td>\n<td style=\"padding:10px;border-top:1px solid #E5E7EB;\">8.5.12<\/td>\n<td style=\"padding:10px;border-top:1px solid #E5E7EB;\">8.5.12<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:10px;border-top:1px solid #E5E7EB;\">8.4<\/td>\n<td style=\"padding:10px;border-top:1px solid #E5E7EB;\">8.4.27<\/td>\n<td style=\"padding:10px;border-top:1px solid #E5E7EB;\">8.4.27<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:10px;border-top:1px solid #E5E7EB;\">8.3<\/td>\n<td style=\"padding:10px;border-top:1px solid #E5E7EB;\">8.3.36<\/td>\n<td style=\"padding:10px;border-top:1px solid #E5E7EB;\">8.3.36<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:10px;border-top:1px solid #E5E7EB;\">8.2<\/td>\n<td style=\"padding:10px;border-top:1px solid #E5E7EB;\">8.2.35<\/td>\n<td style=\"padding:10px;border-top:1px solid #E5E7EB;\">8.2.35<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:10px;border-top:1px solid #E5E7EB;\">8.1 and older<\/td>\n<td style=\"padding:10px;border-top:1px solid #E5E7EB;\">End of life<\/td>\n<td style=\"padding:10px;border-top:1px solid #E5E7EB;\">No upstream fix. Upgrade, or use vendor backports.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>The two vulnerabilities<\/h2>\n<h3>CVE-2026-109618: memory corruption during out-of-memory handling<\/h3>\n<p>PHP enforces the <code>memory_limit<\/code> setting by aborting any request that exceeds it. This can interrupt PHP while internal request data is only partly set up, for example while a form-based file upload is being parsed. Request cleanup may then treat the invalid data as valid, and try to free memory that was never initialised. CVSS v4.0: 9.2.<\/p>\n<h3>CVE-2026-109619: stale global state<\/h3>\n<p>Internal state owned by one request can survive after its memory has been freed, for example after a fatal error. A later request handled by the same worker may then use that stale state before the normal reset runs. CVSS v4.0: 9.2.<\/p>\n<h2>Patch first: step by step<\/h2>\n<ol>\n<li><strong>Find every PHP installation.<\/strong> Include PHP bundled with applications and vendor software, not only the system PHP.<\/li>\n<li><strong>Take a backup<\/strong> of the server or the site before you change anything.<\/li>\n<li><strong>Update to the fixed release<\/strong> for your branch: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. CERT-EU notes that Linux distributions and LTS vendors received the patches in advance, so check your vendor for updated packages.<\/li>\n<li><strong>Restart every worker.<\/strong> Restart PHP-FPM, and Apache or Nginx. Apache with mod_php needs a full restart.<\/li>\n<li><strong>Confirm the version<\/strong> on each installation, and test the sites.<\/li>\n<\/ol>\n<pre style=\"background:#0D1F3C;color:#E5E7EB;padding:14px 16px;border-radius:10px;overflow-x:auto;font-size:14px;\"><code>php -v\n\n# Debian and Ubuntu\nsudo apt update\napt list --upgradable 2&gt;\/dev\/null | grep -i php\n\n# AlmaLinux, Rocky Linux and RHEL\nsudo dnf update &#x27;php*&#x27;\n\n# Restart the services that run PHP\nsudo systemctl restart php-fpm\nsudo systemctl restart httpd    # or nginx, or apache2 on Debian and Ubuntu<\/code><\/pre>\n<p>For control-panel steps, see our <a href=\"https:\/\/underhost.com\/blog\/php-security-release-october-2026-patch-guide\/\">PHP critical security update guide<\/a>, which covers cPanel and WHM with EasyApache 4 25.91, aaPanel, and CloudPanel.<\/p>\n<p>For control-panel steps, the sections below cover cPanel and WHM, servers without a control panel, aaPanel and CloudPanel.<\/p>\n<h2>cPanel and WHM servers<\/h2>\n<ol>\n<li>In WHM, update cPanel &amp; WHM to the latest release. cPanel has published <strong>EasyApache 4 25.91<\/strong> (21 October 2026), which fixes both PHP vulnerabilities in ea-php74 through ea-php85.<\/li>\n<li>Open <strong>WHM &gt; Software &gt; EasyApache 4<\/strong> and build the PHP versions you use. Rebuilding is what installs the fixed PHP packages.<\/li>\n<li>Open <strong>MultiPHP Manager<\/strong> to check the PHP version on each domain.<\/li>\n<li>Check the cPanel version and PHP version over SSH as root:<\/li>\n<\/ol>\n<pre style=\"background:#0D1F3C;color:#E5E7EB;padding:14px 16px;border-radius:10px;overflow-x:auto;font-size:14px;\"><code># cPanel and WHM version (must match the release you installed)\n\/usr\/local\/cpanel\/cpanel -V\n\n# Default PHP version on the server\nphp -v\n\n# Each EasyApache 4 PHP build (ea-php74 to ea-php85)\nls \/opt\/cpanel | grep ea-php<\/code><\/pre>\n<p>To run the cPanel update script from SSH, use the command below. Only run it if your WHM update has not already done so.<\/p>\n<pre style=\"background:#0D1F3C;color:#E5E7EB;padding:14px 16px;border-radius:10px;overflow-x:auto;font-size:14px;\"><code>\/scripts\/upcp --force<\/code><\/pre>\n<h2>Servers without a control panel<\/h2>\n<ol>\n<li><strong>Inventory every PHP installation.<\/strong> Include PHP that ships inside applications or vendor software, not only the system PHP.<\/li>\n<li><strong>Update each one<\/strong> to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 using your distribution&#39;s packages or your vendor&#39;s packages.<\/li>\n<li><strong>Restart the services that run PHP<\/strong> (PHP-FPM, and Apache or Nginx). Apache with mod_php needs a full restart.<\/li>\n<li><strong>Confirm the version<\/strong> for each installation.<\/li>\n<li><strong>Isolate end-of-life PHP<\/strong> from the internet until you can upgrade it.<\/li>\n<\/ol>\n<p>Example commands over SSH. Package and service names differ between distributions, so check them on your server first.<\/p>\n<pre style=\"background:#0D1F3C;color:#E5E7EB;padding:14px 16px;border-radius:10px;overflow-x:auto;font-size:14px;\"><code># Show the PHP version\nphp -v\n\n# Debian and Ubuntu: refresh packages and list PHP updates\nsudo apt update\napt list --upgradable 2&gt;\/dev\/null | grep -i php\n\n# AlmaLinux, Rocky Linux and RHEL: update PHP packages\nsudo dnf update &#x27;php*&#x27;\n\n# Restart PHP-FPM and the web server (names vary by distribution)\nsudo systemctl restart php-fpm\nsudo systemctl restart httpd    # or apache2 on Debian and Ubuntu\n\n# Confirm the version again\nphp -v<\/code><\/pre>\n<p>Use the package and service names your system shows, for example <code>systemctl list-units | grep -i php<\/code>. If a PHP version is not in your repositories, use your vendor&#39;s packages instead of installing from source.<\/p>\n<h2>Platform-specific updates<\/h2>\n<h3>EasyApache 4 packages (cPanel)<\/h3>\n<p>cPanel has published fixed packages: ea-php82 8.2.35, ea-php83 8.3.36, ea-php84 8.4.27 and ea-php85 8.5.12. The nightly cPanel update installs them if automatic updates are on. To install them now, run the commands below as root, then check the versions.<\/p>\n<pre style=\"background:#0D1F3C;color:#E5E7EB;padding:14px 16px;border-radius:10px;overflow-x:auto;font-size:14px;\"><code>dnf update &#x27;ea-php*&#x27;\n\/scripts\/restartsrv_apache_php_fpm\n\n# Check the installed EasyApache 4 PHP versions\ndnf list installed &#x27;ea-php*&#x27;<\/code><\/pre>\n<p>cPanel&#8217;s packages for PHP 8.1 and older do not include the fix. Move those sites to PHP 8.2 or later in <strong>WHM &gt; MultiPHP Manager<\/strong>.<\/p>\n<h3>CloudLinux (alt-php)<\/h3>\n<p>If your PHP comes from CloudLinux alt-php, update it with:<\/p>\n<pre style=\"background:#0D1F3C;color:#E5E7EB;padding:14px 16px;border-radius:10px;overflow-x:auto;font-size:14px;\"><code>dnf update &#x27;alt-php*&#x27;<\/code><\/pre>\n<h3>AlmaLinux, Rocky Linux and RHEL: the Remi repository<\/h3>\n<p>If your PHP comes from the Remi repository (rpms.remirepo.net), PHP says it will not have updates on release day. Switch to your distribution&#8217;s packages, or build from source.<\/p>\n<h3>Debian and Ubuntu<\/h3>\n<p>Update with the commands below. This also picks up updates from the ondrej\/php repository if you use it.<\/p>\n<pre style=\"background:#0D1F3C;color:#E5E7EB;padding:14px 16px;border-radius:10px;overflow-x:auto;font-size:14px;\"><code>sudo apt update &amp;&amp; sudo apt upgrade<\/code><\/pre>\n<h3>Docker and other containers<\/h3>\n<p>Pull the new PHP base image, rebuild the image and redeploy. A running container keeps the old PHP until you replace it.<\/p>\n<p>Linux distributions and LTS vendors received the patches in advance, so most should have packages today. If yours is not available yet, check again later, then install it and restart PHP-FPM or Apache.<\/p>\n<h2>aaPanel servers<\/h2>\n<p><strong>Take a server snapshot or confirm your current backups before you start.<\/strong><\/p>\n<ol>\n<li>Open <strong>App Store<\/strong>, then click <strong>Update App List<\/strong>.<\/li>\n<li>Under <strong>Installed<\/strong>, find PHP 8.2 and PHP 8.3 (and any other PHP version you run).<\/li>\n<li>Use the <strong>Update<\/strong> action for one version at a time.<\/li>\n<li>Check the installation log, then confirm the resulting version.<\/li>\n<\/ol>\n<pre style=\"background:#0D1F3C;color:#E5E7EB;padding:14px 16px;border-radius:10px;overflow-x:auto;font-size:14px;\"><code>php -v<\/code><\/pre>\n<h2>CloudPanel servers<\/h2>\n<p><strong>Take a backup or snapshot first.<\/strong> CloudPanel servers can be updated over SSH with the same package steps as servers without a control panel. Use the PHP packages from your operating system or vendor, as shown below.<\/p>\n<ol>\n<li>Connect over SSH as root, or as a user with sudo.<\/li>\n<li>Check the PHP version the server runs, then update the PHP packages to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.<\/li>\n<li>Restart PHP-FPM and Nginx.<\/li>\n<li>Set the fixed version for each site in CloudPanel: open the site, go to the <strong>PHP Settings<\/strong> tab, select the version, and update.<\/li>\n<li>Test each site, then check the PHP version again.<\/li>\n<\/ol>\n<p>The per-site PHP setting is in the CloudPanel web interface. Check CloudPanel&#8217;s official documentation before you rely on any command-line steps for it.<\/p>\n<h2>If you cannot patch straight away: temporary mitigations<\/h2>\n<p>CERT-EU stresses that only an update fully fixes these vulnerabilities. The measures below reduce exposure to specific attack paths, and they do not make an installation safe. Apply them only until the update is in place and verified.<\/p>\n<h3>For CVE-2026-109618 (memory corruption)<\/h3>\n<ul>\n<li>Set <code>memory_limit=-1<\/code> in a way that applications cannot override, such as <code>php_admin_value<\/code> in the PHP-FPM pool or the Apache configuration. Check that no pool, directory or application setting puts a finite limit back.<\/li>\n<li>Set a low <code>post_max_size<\/code>: 8M for applications that do not accept uploads, or 32M where uploads are needed. Keep <code>upload_max_filesize<\/code> below <code>post_max_size<\/code>.<\/li>\n<li>Limit decoded request size, field count, multipart part count, header count and nesting depth at the web server or proxy. These limits must also cover requests without a usable Content-Length header.<\/li>\n<li>Use a container or cgroup memory limit as an availability boundary. Do not use RLIMIT_AS or RLIMIT_DATA, because they can trigger the vulnerable allocation failure.<\/li>\n<\/ul>\n<h3>For CVE-2026-109619 (stale global state)<\/h3>\n<ul>\n<li>Set <code>session.upload_progress.enabled=0<\/code> in <code>php.ini<\/code>, or in a PHP-FPM pool, then restart every worker. Do not rely on <code>ini_set()<\/code> or <code>.user.ini<\/code>, because they take effect too late.<\/li>\n<li>On PHP 8.5, set <code>fatal_error_backtraces=0<\/code> and restart every worker.<\/li>\n<li>Fix fatal errors and execution timeouts that an attacker could reach, especially in upload and import processing.<\/li>\n<\/ul>\n<p>Hiding diagnostics with <code>error_reporting<\/code>, <code>display_errors<\/code> or <code>@<\/code> does not help.<\/p>\n<h2>Configuration snippets for the temporary workaround<\/h2>\n<p>Use these settings only until the update is installed. They reduce exposure to the known attack paths, but they do not make a server safe. Set them server-wide, in <code>php.ini<\/code>, a PHP-FPM pool, or the Apache configuration. Use <code>php_admin_value<\/code> and <code>php_admin_flag<\/code>, because <code>ini_set()<\/code> and <code>.user.ini<\/code> take effect too late to help. Then restart every PHP worker.<\/p>\n<h3>PHP-FPM pool<\/h3>\n<pre style=\"background:#0D1F3C;color:#E5E7EB;padding:14px 16px;border-radius:10px;overflow-x:auto;font-size:14px;\"><code>; e.g. \/etc\/php-fpm.d\/www.conf\nphp_admin_flag[session.upload_progress.enabled] = off\nphp_admin_value[post_max_size] = 8M\nphp_admin_value[memory_limit] = -1\n; PHP 8.5 only:\nphp_admin_flag[fatal_error_backtraces] = off<\/code><\/pre>\n<p>Then restart PHP-FPM, for example <code>systemctl restart php-fpm<\/code>. A reload may leave old workers running.<\/p>\n<h3>Apache with mod_php<\/h3>\n<pre style=\"background:#0D1F3C;color:#E5E7EB;padding:14px 16px;border-radius:10px;overflow-x:auto;font-size:14px;\"><code># httpd.conf or the site&#x27;s &lt;VirtualHost&gt;\nphp_admin_flag session.upload_progress.enabled off\nphp_admin_value post_max_size 8M\nphp_admin_value memory_limit -1<\/code><\/pre>\n<p>Then restart Apache. mod_php is the highest-risk setup, so update these servers first.<\/p>\n<h3>php.ini<\/h3>\n<pre style=\"background:#0D1F3C;color:#E5E7EB;padding:14px 16px;border-radius:10px;overflow-x:auto;font-size:14px;\"><code>session.upload_progress.enabled = 0\npost_max_size = 8M\nmemory_limit = -1\n; PHP 8.5 only:\nfatal_error_backtraces = 0<\/code><\/pre>\n<p>A pool, directory or application setting can override <code>php.ini<\/code>. Check that nothing sets a finite <code>memory_limit<\/code> back. On cPanel, use <strong>WHM &gt; MultiPHP INI Editor &gt; Editor Mode<\/strong> and repeat the settings for each PHP version.<\/p>\n<h3>What these settings cost you<\/h3>\n<ul>\n<li><strong>post_max_size = 8M<\/strong> caps form posts at 8 MB. If a site takes file uploads, use 32M instead, and keep <code>upload_max_filesize<\/code> below it.<\/li>\n<li><strong>memory_limit = -1<\/strong> removes PHP&#8217;s per-request memory cap, so one runaway script can use all of the server&#8217;s memory. PHP recommends a container or cgroup memory limit as a backstop.<\/li>\n<li>Upload progress bars stop working, but uploads themselves still work.<\/li>\n<\/ul>\n<h3>Check that the settings took effect<\/h3>\n<p>Create a file with a random name in the site&#8217;s document root, containing the line below. Open it in your browser and check <code>session.upload_progress.enabled<\/code>, <code>post_max_size<\/code> and <code>memory_limit<\/code>. Delete the file as soon as you have checked, because it exposes details about your server.<\/p>\n<pre style=\"background:#0D1F3C;color:#E5E7EB;padding:14px 16px;border-radius:10px;overflow-x:auto;font-size:14px;\"><code>&lt;?php phpinfo();<\/code><\/pre>\n<p><code>php -i<\/code> on the command line does not show the web settings, because the command line reads its own configuration.<\/p>\n<h2>End-of-life PHP (8.1 and older)<\/h2>\n<p>The PHP project no longer ships updates for PHP 8.1 and older. Some distributions and LTS vendors backport fixes, so contact your vendor. The PHP team has also published minimal source backports for PHP 7.4, 8.0 and 8.1, for organisations that build from source. The safer option is to move the site to a supported branch.<\/p>\n<p>The community repository rpms.remirepo.net will not have updates on release day. The PHP team urges users to switch to distribution packages or build from source.<\/p>\n<h2>Isolate what you cannot patch<\/h2>\n<p>Where patching is not feasible, CERT-EU advises isolating internet-facing applications from public networks until the fix is applied and verified. Put the affected sites behind an access restriction, or take them offline until they are updated.<\/p>\n<h2>Support dates<\/h2>\n<table style=\"width:100%;border-collapse:collapse;margin:0 0 24px;\">\n<thead>\n<tr style=\"background:#0D1F3C;color:#fff;\">\n<th style=\"padding:10px;text-align:left;\">PHP branch<\/th>\n<th style=\"padding:10px;text-align:left;\">Security support until<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"padding:10px;border-top:1px solid #E5E7EB;\">8.5<\/td>\n<td style=\"padding:10px;border-top:1px solid #E5E7EB;\">31 December 2029<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:10px;border-top:1px solid #E5E7EB;\">8.4<\/td>\n<td style=\"padding:10px;border-top:1px solid #E5E7EB;\">31 December 2028<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:10px;border-top:1px solid #E5E7EB;\">8.3<\/td>\n<td style=\"padding:10px;border-top:1px solid #E5E7EB;\">31 December 2027<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:10px;border-top:1px solid #E5E7EB;\">8.2<\/td>\n<td style=\"padding:10px;border-top:1px solid #E5E7EB;\">31 December 2026 (end of life)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>What UnderHost has done<\/h2>\n<p>All UnderHost shared hosting and managed customer servers have been patched. If you run an unmanaged VPS or dedicated server, update it yourself using the steps above.<\/p>\n<h2>Sources<\/h2>\n<ul>\n<li><a href=\"https:\/\/cert.europa.eu\/publications\/security-advisories\/2026-018\/\">CERT-EU security advisory 2026-018<\/a><\/li>\n<li><a href=\"https:\/\/www.php.net\/index.php#2026-10-20-1\">PHP project announcement<\/a><\/li>\n<li><a href=\"https:\/\/github.com\/NCSC-NL\/php2shell\">NCSC-NL repository (third-party software that embeds PHP)<\/a><\/li>\n<\/ul>\n<p>Need help with an update? Open a ticket through <a href=\"https:\/\/customerpanel.ca\/client\/\">@CustomerPanel<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>PHP has announced two critical security vulnerabilities, rated CVSS v4.0 9.2, with a release on 21 October 2026. Here is how to check your PHP version and patch cPanel and non-panel servers.<\/p>\n","protected":false},"author":20904,"featured_media":5900,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[81,101,47],"tags":[108,187,188,185,186,126],"class_list":["post-5764","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hosting-guides","category-server-security","category-software","tag-tag-cpanel","tag-easyapache","tag-patch","tag-php","tag-security-updates","tag-tag-server-security"],"_links":{"self":[{"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/posts\/5764","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/users\/20904"}],"replies":[{"embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/comments?post=5764"}],"version-history":[{"count":9,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/posts\/5764\/revisions"}],"predecessor-version":[{"id":5932,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/posts\/5764\/revisions\/5932"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/media\/5900"}],"wp:attachment":[{"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/media?parent=5764"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/categories?post=5764"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/tags?post=5764"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}