Hello,

Two critical vulnerabilities in PHP, nicknamed php2shell
(CVE-2026-109618 and CVE-2026-109619), were disclosed today. Either one
can let an unauthenticated attacker run code on a web server by sending
it crafted HTTP requests. PHP rates both 9.2 (Critical) on CVSS v4.0.
AlmaLinux 8, 9, and 10 all ship affected PHP versions.

Our core team has backported the fixes to every PHP stream AlmaLinux
ships, and the patched packages are now in the testing repository.
Please help us verify them so we can release them to production:

    sudo dnf install -y almalinux-release-testing
    sudo dnf upgrade 'php*' --enablerepo=almalinux-testing
    sudo systemctl restart php-fpm

The php:7.4 stream on AlmaLinux 8 is the exception: its fix is already
in production, so a regular "sudo dnf upgrade 'php*'" is all you need.

The blog post has the full details, including package versions, how to
confirm the update, and mitigations if you can't update right away:

https://almalinux.org/blog/2026-10-21-php2shell-cve-2026-109618-cve-2026-109619/

Please report any problems in AlmaLinux chat (https://chat.almalinux.org)
or on https://bugs.almalinux.org.

Thank you for helping us test!