Release by release
| Release | Status | Fixed package | Advisory |
|---|---|---|---|
| EL8 php82 | Fixed packageRepoview changelog date; entries say 'Update to X - php.net release page', CVEs not named. | php82 8.2.35-1.module_php.8.2.el8.remi | –2026-10-21 |
| EL8 php83 / php84 / php85 | Fixed packageRepoview changelog date. | 8.3.36 / 8.4.27 / 8.5.12 | –2026-10-22 |
| EL9 php82 | Fixed packageRepoview changelog date. | php 8.2.35-1.module_php.8.2.el9.remi | –2026-10-21 |
| EL9 php83 / php84 / php85 | Fixed packageListed in repoview; changelog date not recorded. | 8.3.36 / 8.4.27 / 8.5.12 | – |
| EL10 php82 / php83 / php85 | Fixed packageListed in repoview; changelog date not recorded. | 8.2.35 / 8.3.36 / 8.5.12 | – |
| EL10 php84 | Fixed packagePackage listed in repoview; changelog date not captured. | php 8.4.27-1.module_php.8.4.el10.remi | – |
| RC1 builds (8.4.27RC1, 8.5.12RC1) | No fix yetNot fixed; do not use. | – | – |
| Older PHP (8.1, 8.0, 7.x) and Fedora-line repos | UnclearNot checked. Remi press coverage said 'not today' at ~13:45-17:09 UTC on 2026-10-21; repo updated later. | – | – |
Confirm the fix is installed
rpm -q php-fpm # expect 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 or newer; Remi changelog may not name the CVEs: rpm -q --changelog php-fpm | grep -m1 -E 'CVE-2026-10961[89]|release page'Restart PHP
Installing the package replaces the files on disk. PHP processes that are already running keep the old code.
sudo dnf upgrade 'php*' && sudo systemctl restart php-fpm && sudo systemctl restart httpdIf your release has no fix yet
Watch the advisory feed for your release and install the update the day it lands. Until then, the triage page lists the official temporary measures. If your release is past its end of life, read options for old versions.