RHEL, Rocky, AlmaLinux & related systems
Identify whether the runtime is provided by the OS, an application stream or a third-party repository. Query the installed RPM revision and the vendor’s security errata. Keep packages from a consistent stream. The commands are examples for unversioned php-* packages; parallel or panel-managed packages have different names. A third-party source must provide its own evidence that both fixes are included.
Alpine Linux
Record the Alpine release, repository and complete package revision. Query the branch actually installed, such as php83 or php84, and check Alpine’s security package information. Upgrade matching extensions together, then restart the corresponding FPM service or replace the container. An Alpine package suffix is a reason to check vendor evidence, not an automatic finding of vulnerability.
Distribution versions and backports
Ubuntu, Debian and enterprise Linux vendors often retain an older upstream number while adding security patches to a package revision. A banner such as 8.3.6 does not prove that a machine is vulnerable or fixed. Match the OS release, repository, architecture and installed revision to the vendor’s status for BOTH CVEs. This site deliberately does not invent package cutoffs.
3. Restart and verify every instance
Installing a new binary leaves old worker processes in memory until they exit. Restart Apache for mod_php or the corresponding PHP-FPM services and pools. Restart queue workers and scheduled long-running processes too. Verify service start times, Web runtime version, package revision, health checks and every load-balanced replica. Delete any temporary diagnostic page immediately; do not leave phpinfo() publicly accessible.
Command example / RPM
rpm -q php-common php-fpm php-cli
dnf updateinfo info --cves CVE-2026-109618,CVE-2026-109619
# Confirm that the enabled vendor repository contains the fix first.
sudo dnf upgrade php-common php-fpm php-cli
sudo systemctl restart php-fpmCommand example / ALPINE
apk info -v | grep '^php'
apk policy php84 php84-fpm
# Example: PHP 8.4 packages; match your installed branch.
sudo apk update
sudo apk upgrade php84 php84-fpm
sudo rc-service php-fpm84 restart