Exposure assessment ≠ compromise detection. This guide cannot determine whether a particular system was compromised. Verify the current advisory and your exact runtime.

Check the release and package source

This example is for Ubuntu 24.04 using the official PHP 8.3 packages shown. USN-8948-1 lists 8.3.6-0ubuntu0.24.04.13 as a fixed revision for that release. Do not apply this threshold to a PPA or another distribution. Verify the current notice for both CVEs.

Other Ubuntu releases have different packages and support conditions. Ubuntu 22.04’s maintained package illustrates a PHP 8.1 backport; an upstream end-of-life label does not negate a confirmed supported distribution fix.

Ubuntu 24.04 / installed PHP 8.3 FPM packages only
cat /etc/os-release
dpkg-query -W php8.3-fpm php8.3-common php8.3-cli
apt-cache policy php8.3-fpm php8.3-common php8.3-cli

Before you change the runtime

Record the current package revision, runtime handler, configuration and deployment topology. Confirm a current fix for both CVEs from the responsible vendor. Back up application data and configuration using a tested restore process. If an incident is suspected, preserve evidence before changing processes or files.

Test the intended PHP build with the application, extensions, scheduled jobs and database in staging. Plan a maintenance window or a rolling change with health checks. Keep a configuration and application rollback plan; do not restore a vulnerable runtime to public traffic without restricting exposure.

Apply the supported package update

After preparation and staging checks, review the proposed package transaction. Include any other installed PHP 8.3 extension packages that the security update requires. If these exact packages are not installed or the service has a different name, identify the correct deployment before proceeding.

This command sequence does not update Apache mod_php or a separately installed panel runtime. Check virtual-host handler mappings and every FPM pool.

Change example — Ubuntu 24.04 official PHP 8.3 FPM only
sudo apt update
sudo apt install --only-upgrade php8.3-fpm php8.3-common php8.3-cli
sudo systemctl restart php8.3-fpm
sudo systemctl status php8.3-fpm --no-pager

Verify the result and handle a delayed patch

Check the actual web-serving binary, package revision or image on every instance. Replace old workers and verify their startup times. Validate application health, uploads, sessions, queue workers and scheduled jobs. CLI output alone does not prove what serves HTTP requests.

If a fixed deployment fails compatibility checks, restrict access and escalate to your vendor or administrator. Temporary WAF or configuration changes may reduce specific attack paths but are not a complete substitute for patching. Investigate suspicious activity separately: a successful update cannot establish that the system was never compromised.

CHECK THE ORIGINAL GUIDANCE

Sources & further reading

Ubuntu · USN-8948-1↗Ubuntu · CVE-2026-109619↗Debian · apt-get manual↗systemd · systemctl manual↗

Advisory snapshot: 2026-10-22. Next review due: 2026-10-29. Recheck sources before acting; this site does not update advisories automatically.