Release by release
| Release | Status | Fixed package | Advisory |
|---|---|---|---|
| 8 php:7.4, php:8.2 | No fix yetBlog (2026-10-21 14:36 UTC) said patches in progress, testing repo 'later today'. No ALSA in errata JSON at check time. | – | – |
| 9 default (8.0), php:8.2, php:8.3 | No fix yetSame; in progress, no ALSA found. | – | – |
| 10 default (8.3), php8.4 | No fix yetSame; in progress, no ALSA found. Kitten 10 gets fix with next PHP update. | – | – |
| 8 php:7.2 (default), 7.3, 8.0; 9 php:8.1 | UnclearNot in first patch round per Alma blog. | – | – |
Confirm the fix is installed
rpm -q --changelog php-fpm | grep -m1 -E 'CVE-2026-10961[89]' # streams: dnf module list phpRestart PHP
Installing the package replaces the files on disk. PHP processes that are already running keep the old code.
sudo systemctl restart php-fpm && sudo systemctl restart httpd # stream switch: sudo dnf module reset php && sudo dnf module enable php:8.2 && sudo dnf distro-sync 'php*'If your release has no fix yet
Watch the advisory feed for your release and install the update the day it lands. Until then, the triage page lists the official temporary measures. If your release is past its end of life, read options for old versions.