Self-check: is your server patched?

Any server: check the PHP that actually serves web requests

The PHP CLI (php -v) can be a different build from the one behind your web server. The most reliable check is a temporary file served by the site itself. Delete it immediately afterwards.

Create a temporary file in your web root (random name):

echo '<?php echo PHP_VERSION, " ", PHP_SAPI;' > ./v-$(openssl rand -hex 6).php

Open it in a browser, note the version and SAPI, then delete it:

rm ./v-*.php

CLI version (may differ from the web version):

php -v

List running PHP services:

systemctl list-units --type=service 'php*'

Ubuntu / Debian packages

Distribution packages keep the old upstream version number when a fix is backported, so compare the package version with the vendor advisory, or search the package changelog for the CVE ID.

Full guide: how to update and verify

Installed PHP packages and versions:

dpkg -l 'php*' 'libapache2-mod-php*' | grep ^ii

Does the changelog mention the fix? (replace 8.3 with your branch)

zgrep -E "CVE-2026-10961[89]" /usr/share/doc/php8.3-common/changelog.Debian.gz

Install the update:

sudo apt update && sudo apt install --only-upgrade "php8.3*"

Restart PHP-FPM / Apache so the new binary is loaded:

sudo systemctl restart php8.3-fpm apache2

RHEL / AlmaLinux / Rocky / CentOS Stream

Red Hat backports fixes without changing the upstream version. Search the RPM changelog for the CVE ID.

Full guide: how to update and verify

Installed PHP packages:

rpm -qa | grep -Ei "^(php|ea-php|alt-php)" | sort

Does the changelog mention the fix?

rpm -q --changelog php-common | grep -E "CVE-2026-10961[89]"

Install the update and restart:

sudo dnf upgrade "php*" && sudo systemctl restart php-fpm httpd

cPanel / WHM (EasyApache 4) and CloudLinux alt-php

Each PHP version is installed side by side. Check every version a site can be assigned to, not just the default.

Full guide: how to update and verify

Which versions are in use: WHM → Software → MultiPHP Manager.

EasyApache PHP versions:

for p in /opt/cpanel/ea-php*/root/usr/bin/php; do $p -v | head -1; done

CloudLinux alt-php versions:

for p in /opt/alt/php*/usr/bin/php; do $p -v | head -1; done

Backport check for an alt-php build (replace 81):

rpm -q --changelog alt-php81-common | grep -E "CVE-2026-10961[89]"

Update packages:

sudo dnf upgrade "ea-php*" "alt-php*"   # or: yum update

Plesk

Plesk ships its own PHP builds under /opt/plesk/php. Update them from Tools & Settings → Updates.

Full guide: how to update and verify

List PHP handlers and versions:

plesk bin php_handler --list

Version of a specific build:

/opt/plesk/php/8.3/bin/php -v

Install updates from the command line:

plesk installer --select-release-current --upgrade-installed-components

aaPanel / BT Panel (宝塔)

aaPanel compiles PHP into /www/server/php/<version>. Each installed version must be updated or recompiled separately.

Full guide: how to update and verify

Installed versions:

for p in /www/server/php/*/bin/php; do echo "$p: $($p -r "echo PHP_VERSION;")"; done

Update: App Store → PHP-x.y → Settings → Update (or reinstall the latest minor version).

Docker / Kubernetes

Rebuilding with an updated base image is the fix. A running container never updates itself.

Full guide: how to update and verify

Which images are running:

docker ps --format '{{.Names}}\t{{.Image}}'

PHP version inside a container:

docker exec <container> php -v

Pull the fixed official tag and rebuild (example):

docker pull php:8.3.36-fpm && docker compose build --pull && docker compose up -d

WordPress on shared or managed hosting

On shared hosting you usually cannot patch PHP yourself. Confirm the version, then switch to a fixed version in the hosting panel or ask your host whether their build includes the fix.

Full guide: how to update and verify

WordPress admin → Tools → Site Health → Info → Server → PHP version.

In your hosting panel, select a fixed PHP version (8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later).

If the panel shows only "8.3" without a patch number, ask support: "Does your PHP build include the fixes for CVE-2026-109618 and CVE-2026-109619?"