Release by release
| Release | Status | Fixed package | Advisory |
|---|---|---|---|
| 26.10 (stonking) | Fixed packageUbuntu backports; version is not upstream 8.5.12. | php8.5 8.5.9-0ubuntu2.1 | USN-8948-12026-10-21 |
| 26.04 LTS (resolute) | Fixed package | php8.5 8.5.4-0ubuntu1.5 | USN-8948-12026-10-21 |
| 24.04 LTS (noble) | Fixed packageChangelog reportedly carries CVE-2026-109618_109619.patch (secondary source ma.ttias.be, not verified on primary). | php8.3 8.3.6-0ubuntu0.24.04.13 | USN-8948-12026-10-21 |
| 22.04 LTS (jammy) | Fixed package | php8.1 8.1.2-1ubuntu2.28 | USN-8948-12026-10-21 |
| 20.04 LTS (focal) ESM | Fixed packageUbuntu Pro (ESM) subscription required. | php7.4 7.4.3-4ubuntu2.29+esm5 | USN-8948-22026-10-21 |
| 18.04 LTS (bionic) ESM | Fixed packageUbuntu Pro (ESM) required. | php7.2 7.2.24-0ubuntu0.18.04.17+esm14 | USN-8948-22026-10-21 |
| 16.04 LTS (xenial) ESM | Fixed packageUbuntu Pro plus Legacy Support add-on required. | php7.0 7.0.33-0ubuntu0.16.04.16+esm22 | USN-8948-22026-10-21 |
| 14.04 LTS (trusty) ESM | Fixed packageUbuntu Pro plus Legacy Support add-on required. | php5 5.5.9+dfsg-1ubuntu4.29+esm18 | USN-8948-22026-10-21 |
Confirm the fix is installed
apt changelog php8.3-fpm | grep -m1 -E 'CVE-2026-10961[89]' # replace 8.3 with your php version; or: zgrep -m1 -E 'CVE-2026-10961[89]' /usr/share/doc/php8.3-fpm/changelog.Debian.gzRestart PHP
Installing the package replaces the files on disk. PHP processes that are already running keep the old code.
sudo systemctl restart php8.3-fpm && sudo systemctl restart apache2 # replace 8.3 with your version; USN gives no explicit restart note