Release by release
| Release | Status | Fixed package | Advisory |
|---|---|---|---|
| RHEL 8 module php:7.4 (incl. 8.10 ELS) | Fixed packageRated Important, CVSS v3 8.1. | php-7.4.33-8.module+el8.10.0+25117+30337cca | RHSA-2026:870802026-10-21 |
| RHEL 8 module php:8.2 | No fix yetKnown affected, no fix yet. | – | – |
| RHEL 9 php default, php:8.2, php:8.3, php:8.4 | No fix yetKnown affected, no fix yet. | – | – |
| RHEL 10 php, php8.4 | No fix yetKnown affected, no fix yet. | – | – |
| RHEL 7 | UnclearCSAF: known_affected for CVE-2026-109619, not affected for CVE-2026-109618. Conflicting; no fix listed. | – | – |
| RHEL 6 | UnclearCVE-2026-109619 'no fix planned: out of support scope'; CVE-2026-109618 not affected. | – | – |
Confirm the fix is installed
rpm -q --changelog php-fpm | grep -m1 -E 'CVE-2026-10961[89]' # list modules: dnf module list php; mod_php on EL8: httpd -M 2>/dev/null | grep -E 'mpm_|php'Restart PHP
Installing the package replaces the files on disk. PHP processes that are already running keep the old code.
sudo systemctl restart php-fpm && sudo systemctl restart httpdIf your release has no fix yet
Watch the advisory feed for your release and install the update the day it lands. Until then, the triage page lists the official temporary measures. If your release is past its end of life, read options for old versions.