Release by release
| Release | Status | Fixed package | Advisory |
|---|---|---|---|
| edge, v3.24 (php84) | No fix yetsecdb lists fix, but x86_64 APKINDEX still had 8.4.26-r0 at ~17:30 UTC 2026-10-21. Secdb labels CVE-2026-109619 as GHSA-7875-c8px-7q5f, differing from upstream GHSA-6wmf-4rv5-p3rp. | 8.4.27-r0 (secdb only; index still 8.4.26-r0) | – |
| edge, v3.24 (php85) | No fix yetSame as php84. | 8.5.12-r0 (secdb only; index still 8.5.11-r0) | – |
| edge, v3.24 (php83) | No fix yetNo fix entry; index max 8.3.35-r0. | – | – |
| v3.23 (php83 8.3.31-r0, php84 8.4.21-r0, php85 8.5.6-r0) | No fix yetNo fix. | – | – |
| v3.22 (php82 8.2.33-r0, php83 8.3.29-r0, php84 8.4.16-r0) | No fix yetNo fix. php82 absent from edge and v3.24. | – | – |
Confirm the fix is installed
apk info -v php84-fpm # compare against 8.4.27-r0 / 8.5.12-r0; apk has no changelog, check versionRestart PHP
Installing the package replaces the files on disk. PHP processes that are already running keep the old code.
sudo rc-service php-fpm84 restart # verify service name with: rc-service -l | grep phpIf your release has no fix yet
Watch the advisory feed for your release and install the update the day it lands. Until then, the triage page lists the official temporary measures. If your release is past its end of life, read options for old versions.