Release by release
| Release | Status | Fixed package | Advisory |
|---|---|---|---|
| 13 trixie (stable) | Fixed packageBase-suite 8.4.24-1~deb13u1 is vulnerable. | php8.4 8.4.27-1~deb13u1 | DSA-6574-12026-10-21 |
| 12 bookworm (oldstable / LTS) | Fixed packageBase-suite 8.2.32-1~deb12u1 is vulnerable. | php8.2 8.2.35-1~deb12u1 | DLA-4848-12026-10-21 |
| forky / sid (testing / unstable) | No fix yetTracker shows 8.4.26-1 unfixed; Debian bug 1151516. | – | – |
| 11 bullseye (php7.4) | UnclearNot listed in tracker at check time. | – | – |
Confirm the fix is installed
apt changelog php8.4-fpm | grep -m1 -E 'CVE-2026-10961[89]' # or zgrep -m1 -E 'CVE-2026-10961[89]' /usr/share/doc/php8.4-fpm/changelog.Debian.gzRestart PHP
Installing the package replaces the files on disk. PHP processes that are already running keep the old code.
sudo systemctl restart php8.4-fpm && sudo systemctl restart apache2 # use php8.2-fpm on bookwormIf your release has no fix yet
Watch the advisory feed for your release and install the update the day it lands. Until then, the triage page lists the official temporary measures. If your release is past its end of life, read options for old versions.