Release by release
| Release | Status | Fixed package | Advisory |
|---|---|---|---|
| Amazon Linux 2 (php core, Php8.2 extra) | No fix yetPending Fix; no ALAS ID. | – | – |
| Amazon Linux 2023 php8.2, 8.3, 8.4, 8.5 | No fix yetPending Fix; no ALAS ID. | – | – |
| Amazon Linux 2023 php8.1 | UnclearALAS lists 'No Fix Planned'; package stays unpatched. Not a not-affected statement. | – | – |
| Amazon Linux 2027 Preview php8.5 | No fix yetPending Fix. | – | – |
Confirm the fix is installed
rpm -q --changelog php-fpm | grep -m1 -E 'CVE-2026-10961[89]'Restart PHP
Installing the package replaces the files on disk. PHP processes that are already running keep the old code.
sudo systemctl restart php-fpm && sudo systemctl restart httpd # AL2: sudo yum update 'php*'; AL2023: sudo dnf upgrade 'php*'If your release has no fix yet
Watch the advisory feed for your release and install the update the day it lands. Until then, the triage page lists the official temporary measures. If your release is past its end of life, read options for old versions.