Ubuntu & Debian
Identify the installed php*-common package and the Web handler’s package, then consult the Ubuntu or Debian security tracker for both CVEs. The commands below use PHP 8.3 as an example; substitute your actual branch. Ensure the enabled repository offers a fixed revision before upgrading. If a package changelog is unavailable or does not mention the CVE, obtain the vendor advisory rather than treating silence as a clean result.
Distribution versions and backports
Ubuntu, Debian and enterprise Linux vendors often retain an older upstream number while adding security patches to a package revision. A banner such as 8.3.6 does not prove that a machine is vulnerable or fixed. Match the OS release, repository, architecture and installed revision to the vendor’s status for BOTH CVEs. This site deliberately does not invent package cutoffs.
3. Restart and verify every instance
Installing a new binary leaves old worker processes in memory until they exit. Restart Apache for mod_php or the corresponding PHP-FPM services and pools. Restart queue workers and scheduled long-running processes too. Verify service start times, Web runtime version, package revision, health checks and every load-balanced replica. Delete any temporary diagnostic page immediately; do not leave phpinfo() publicly accessible.
Command example / DEBIAN
dpkg-query -W -f='${Package} ${Version}\n' 'php*-common'
apt-cache policy php8.3-common php8.3-fpm
# Search your installed package's security changelog.
zgrep -Ei 'CVE-2026-109618|CVE-2026-109619' \
/usr/share/doc/php8.3-common/changelog.Debian.gzCommand example / APT
sudo apt update
apt list --upgradable
# Example: installed PHP 8.3 packages; use your actual branch.
sudo apt install --only-upgrade php8.3-common php8.3-fpm php8.3-cli
sudo systemctl restart php8.3-fpm
systemctl status php8.3-fpm --no-pager