Release by release
| Release | Status | Fixed package | Advisory |
|---|---|---|---|
| ppa:ondrej/php noble and jammy | Fixed packagePublished 14:45Z. Launchpad API checked; arm64 binary state not verified. 7.4 -31 changelog reportedly has Avoid-state-corruption-via-bailout patch (secondary source ma.ttias.be); 8.1/8.0 changelogs not verified. | 8.5.12-1, 8.4.27-1, 8.3.36-1, 8.2.35-1, 8.1.34-9, 1:8.0.30-25, 1:7.4.33-31 (each with +ubuntu24.04.1+deb.sury.org+1 or +ubuntu22.04.1+deb.sury.org+1) | –2026-10-21 |
| packages.sury.org/php amd64 (trixie, bookworm, bullseye) | Fixed packageBuild suffix shown is the trixie one; other suites have the same upstream versions with their own suffix. | php8.5-fpm 8.5.12-1+0~20261021.27+debian13~1.gbp1a3e8a; php8.4-fpm 8.4.27-1+0~20261021.57+debian13~1.gbp7636b9; php8.3-fpm 8.3.36-1+0~20261021.88+debian13~1.gbp250f7c; php8.2-fpm 8.2.35-1+0~20261021.94+debian13~1.gbp8bff78 | –2026-10-21 |
| packages.sury.org/php arm64 | No fix yetIndexes still showed 8.2.34, 8.3.35, 8.4.26, 8.5.11 from 202609xx builds. | – | – |
Confirm the fix is installed
apt changelog php8.4-fpm | grep -m1 -E 'CVE-2026-10961[89]|Avoid-state-corruption' # sury changelogs may not name the CVEs; also check version >= 8.4.27 etc.Restart PHP
Installing the package replaces the files on disk. PHP processes that are already running keep the old code.
sudo systemctl restart php8.4-fpm && sudo systemctl restart apache2If your release has no fix yet
Watch the advisory feed for your release and install the update the day it lands. Until then, the triage page lists the official temporary measures. If your release is past its end of life, read options for old versions.