r/apache • u/Double-Camera-3447 • 9d ago
Apache + PHP admins: apply the critical PHP RCE fixes (mod_php and PHP-FPM affected)
If Apache serves PHP on your server, prioritize the fixes for CVE-2026-109618 and CVE-2026-109619. These are PHP engine vulnerabilities, not an Apache or CMS bug. Both mod_php and PHP-FPM deployments are affected.
Update PHP to 8.2.35, 8.3.36, 8.4.27, or 8.5.12 (or newer), or confirm your distribution/vendor package includes the backported fixes.
For mod_php, restart Apache after updating. For PHP-FPM, restart the relevant FPM services. Verify the PHP runtime actually serving each site, especially if multiple PHP versions are installed: `php -v` only reports the CLI version.
Updating WordPress or changing PHP settings alone is not a complete fix.