Release by release
| Release | Status | Fixed package | Advisory |
|---|---|---|---|
| SLE 15 SP7 (Web and Scripting module), SLES, SAP | No fix yetIn QA, no SUSE-SU ID. Only TID-PHP-RCE-202610 (technical info document, 2026-10-21). | php8 8.3.36-150700.3.24.1 or later (in QA) | – |
| SLES 15 SP6 LTSS / SAP | No fix yetIn QA, no SUSE-SU ID. | php8 8.2.35-150600.3.39.1 or later (in QA) | – |
| SLES 16.0 / 16.1 | No fix yetphp8 fix in progress. | – | – |
| SLES 16.2, Leap 16.0/16.1, SP4/SP5 php8, BCI php containers | Not affectedPer SUSE CVE page. | – | – |
| php7 (Legacy, Package Hub modules, Leap 15.3-15.6) | No fix yetMarked Affected on many products; no fix. | – | – |
Confirm the fix is installed
rpm -q --changelog php8-fpm | grep -m1 -E 'CVE-2026-10961[89]'Restart PHP
Installing the package replaces the files on disk. PHP processes that are already running keep the old code.
sudo systemctl restart php-fpm && sudo systemctl restart apache2If your release has no fix yet
Watch the advisory feed for your release and install the update the day it lands. Until then, the triage page lists the official temporary measures. If your release is past its end of life, read options for old versions.