Hello, Two critical vulnerabilities in PHP, nicknamed php2shell (CVE-2026-109618 and CVE-2026-109619), were disclosed today. Either one can let an unauthenticated attacker run code on a web server by sending it crafted HTTP requests. PHP rates both 9.2 (Critical) on CVSS v4.0. AlmaLinux 8, 9, and 10 all ship affected PHP versions. Our core team has backported the fixes to every PHP stream AlmaLinux ships, and the patched packages are now in the testing repository. Please help us verify them so we can release them to production: sudo dnf install -y almalinux-release-testing sudo dnf upgrade 'php*' --enablerepo=almalinux-testing sudo systemctl restart php-fpm The php:7.4 stream on AlmaLinux 8 is the exception: its fix is already in production, so a regular "sudo dnf upgrade 'php*'" is all you need. The blog post has the full details, including package versions, how to confirm the update, and mitigations if you can't update right away: https://almalinux.org/blog/2026-10-21-php2shell-cve-2026-109618-cve-2026-109... Please report any problems in AlmaLinux chat (https://chat.almalinux.org) or on https://bugs.almalinux.org. Thank you for helping us test! -- Jonathan Wright AlmaLinux OS Foundation Mattermost: chat <https://chat.almalinux.org/almalinux/messages/@jonathan>