Summary
On Ubuntu and Debian, the fix is installed through a normal package update: apt update && apt upgrade, followed by a PHP-FPM restart. The version number does not change, so verify the result in the package changelog. The whole procedure takes about two minutes and does not require a server reboot.
Step 1. Check what is installed
dpkg -l | grep -E 'php[0-9.]+-(fpm|cli|common)'
php -vNote the package version number. You will use it to confirm that the update was applied.
Step 2. Update the packages
sudo apt update
sudo apt install --only-upgrade 'php8.*'If PHP was installed from a third-party repository (ppa:ondrej/php on Ubuntu, packages.sury.org on Debian), refresh that repository's package list first. Fixes arrive there separately from the main distribution repository.
Step 3. Restart PHP-FPM
This step is mandatory. PHP-FPM worker processes keep the old code in memory: until you restart them, the server stays vulnerable even though the files on disk are already new.
sudo systemctl restart php8.3-fpm
systemctl status php8.3-fpm --no-pagerSubstitute your own version for 8.3. If you have several PHP versions, restart each one:
systemctl list-units 'php*-fpm*' --no-legend | awk '{print $1}' | xargs -r sudo systemctl restartIf you use mod_php instead of FPM, restart the web server: sudo systemctl restart apache2.
Step 4. Verify the result
zgrep -m1 'CVE-2026-109618' /usr/share/doc/php8.3-fpm/changelog.Debian.gz
dpkg -l | grep php8.3-fpmThe first command should print a line containing the CVE number. On Ubuntu 24.04, the fixed package version is 8.3.6-0ubuntu0.24.04.13 or newer.
Why the version number did not change
Ubuntu and Debian maintain a single PHP version for the entire lifetime of a release and backport security fixes into it from newer versions. This is called backporting. As a result, php -v on a patched server still shows 8.3.6 even though the vulnerabilities are closed. The only reliable indicator is the package version and its changelog.
If PHP was built manually
PHP built from source does not receive updates. Download 8.3.36 (or 8.4.27, 8.5.12 for those branches) from php.net, build it with the same options as before, which you can look up with php -i | grep "Configure Command", and restart the services.
Frequently asked questions
Do I need to reboot the server after a PHP update?
No. Restarting PHP-FPM and the web server is enough.
What happens to websites during the PHP-FPM restart?
A PHP-FPM restart takes a fraction of a second. Requests during that moment may receive a 502 error. On busy sites, use systemctl reload where it is supported, or take the server out of the load balancer during the restart.
How do I update PHP on many servers at once?
Collect the version list with a single command over SSH and update in batches. An example script is in our article on auditing a server fleet.