On Thursday, 22 October 2026 at 11:13 PM, Francesco Di Nucci <francesco.dinucci@na.infn.it> wrote:

The Alma blog post (https://almalinux.org/blog/2026-10-21-php2shell-cve-2026-109618-cve-2026-109619/) lists the package versions with the fixes (quote below).

Check the package versions and eventually update:

AlmaLinux 8

php:7.2 stream: php-7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1
php:7.3 stream: php-7.3.20-1.module_el8.10.0+4316+90ea5fe5.alma.1
php:7.4 stream: php-7.4.33-8.module_el8.10.0+4321+cf5fd4bb (Red Hat’s update, released directly to production)
php:8.0 stream: php-8.0.30-1.module_el8.10.0+4319+26f10322.alma.1
php:8.2 stream: php-8.2.33-1.module_el8.10.0+4320+c30d6dbb.alma.1

AlmaLinux 9

Default (PHP 8.0): php-8.0.30-8.el9_8.alma.1
php:8.1 stream: php-8.1.32-1.module_el9.8.0+326+528679fc.alma.1
php:8.2 stream: php-8.2.33-1.module_el9.8.0+327+37dfd4b4.alma.1
php:8.3 stream: php-8.3.33-1.module_el9.8.0+328+1fdeb728.alma.1

AlmaLinux 10

Default (PHP 8.3): php-8.3.33-1.el10_2.alma.1
PHP 8.4 (php8.4 packages): php8.4-8.4.24-1.el10_2.alma.1

AlmaLinux Kitten 10

The fix will ride along in the next regular PHP update, so no separate build is being made.
--
Francesco Di Nucci
System Administrator
Compute & Networking Service, INFN Naples

Email: francesco.dinucci@na.infn.it
On 22/10/26 15:23, Turritopsis Dohrnii Teo En Ming via AlmaLinux Users wrote:
Subject: PHP security vulnerabilities on my AlmaLinux 9.8

Good day from Singapore,

Can I check and confirm with you whether the PHP security vulnerabilities disclosed on 21 Oct 2026 have been fixed in my AlmaLinux 9.8?

[root@ns1 ~]# cat /etc/os-release

NAME="AlmaLinux"

VERSION="9.8 (Olive Jaguar)"

ID="almalinux"

ID_LIKE="rhel centos fedora"

VERSION_ID="9.8"

PLATFORM_ID="platform:el9"

PRETTY_NAME="AlmaLinux 9.8 (Olive Jaguar)"

ANSI_COLOR="0;34"

LOGO="fedora-logo-icon"

CPE_NAME="cpe:/o:almalinux:almalinux:9::baseos"

HOME_URL="https://almalinux.org/"

DOCUMENTATION_URL="https://wiki.almalinux.org/"

BUG_REPORT_URL="https://bugs.almalinux.org/"

ALMALINUX_MANTISBT_PROJECT="AlmaLinux-9"

ALMALINUX_MANTISBT_PROJECT_VERSION="9.8"

REDHAT_SUPPORT_PRODUCT="AlmaLinux"

REDHAT_SUPPORT_PRODUCT_VERSION="9.8"

SUPPORT_END=2032-06-01

[root@ns1 ~]# rpm -qa | grep -i '^php'

php-pecl-zip-1.19.2-6.el9.x86_64

php-pear-1.10.14-1.el9.noarch

php-pspell-8.0.30-3.el9.x86_64

php-common-8.0.30-8.el9_8.alma.1.x86_64

php-pdo-8.0.30-8.el9_8.alma.1.x86_64

php-mysqlnd-8.0.30-8.el9_8.alma.1.x86_64

php-cli-8.0.30-8.el9_8.alma.1.x86_64

php-fpm-8.0.30-8.el9_8.alma.1.x86_64

php-gd-8.0.30-8.el9_8.alma.1.x86_64

php-intl-8.0.30-8.el9_8.alma.1.x86_64

php-mbstring-8.0.30-8.el9_8.alma.1.x86_64

php-opcache-8.0.30-8.el9_8.alma.1.x86_64

php-process-8.0.30-8.el9_8.alma.1.x86_64

php-xml-8.0.30-8.el9_8.alma.1.x86_64

[root@ns1 ~]# dnf updateinfo list --security

Last metadata expiration check: 2:09:59 ago on Thu 22 Oct 2026 11:46:51 AM +08.

[root@ns1 ~]# dnf updateinfo info --cve CVE-2026-109618

Last metadata expiration check: 2:10:22 ago on Thu 22 Oct 2026 11:46:51 AM +08.

[root@ns1 ~]# dnf updateinfo info --cve CVE-2026-109619

Last metadata expiration check: 2:10:35 ago on Thu 22 Oct 2026 11:46:51 AM +08.

[root@ns1 ~]# systemctl status httpd

● httpd.service - The Apache HTTP Server

Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; preset: disabled)

Drop-In: /usr/lib/systemd/system/httpd.service.d

└─php-fpm.conf

Active: active (running) since Thu 2026-10-22 07:18:37 +08; 6h ago

Docs: man:httpd.service(8)

Main PID: 1081 (httpd)

Status: "Total requests: 2945; Idle/Busy workers 100/0;Requests/sec: 0.123; Bytes served/sec: 1.5KB/sec"

Tasks: 231 (limit: 74628)

Memory: 54.8M (peak: 56.5M)

CPU: 45.196s

CGroup: /system.slice/httpd.service

├─1081 /usr/sbin/httpd -DFOREGROUND

├─1183 /usr/sbin/httpd -DFOREGROUND

├─1188 /usr/sbin/httpd -DFOREGROUND

├─1194 /usr/sbin/httpd -DFOREGROUND

├─1212 /usr/sbin/httpd -DFOREGROUND

├─1224 /usr/sbin/httpd -DFOREGROUND

└─7507 /usr/sbin/httpd -DFOREGROUND

Oct 22 07:18:37 ns1.example.com systemd[1]: Starting The Apache HTTP Server...

Oct 22 07:18:37 ns1.example.com systemd[1]: Started The Apache HTTP Server.

Oct 22 07:18:37 ns1.example.com httpd[1081]: Server configured, listening on: port 443, port 80

[root@ns1 ~]# systemctl status php-fpm

● php-fpm.service - The PHP FastCGI Process Manager

Loaded: loaded (/usr/lib/systemd/system/php-fpm.service; enabled; preset: disabled)

Drop-In: /etc/systemd/system/php-fpm.service.d

└─00-virtualmin.conf

Active: active (running) since Thu 2026-10-22 13:53:38 +08; 4min 23s ago

Main PID: 132343 (php-fpm)

Status: "Processes active: 0, idle: 35, Requests: 0, slow: 0, Traffic: 0req/sec"

Tasks: 36 (limit: 74628)

Memory: 39.1M (peak: 39.8M)

CPU: 495ms

CGroup: /system.slice/php-fpm.service

├─132343 "php-fpm: master process (/etc/php-fpm.conf)"

├─132400 "php-fpm: pool 163465190630155"

├─132401 "php-fpm: pool 163465190630155"

├─132402 "php-fpm: pool 163465190630155"

├─132403 "php-fpm: pool 16351709215424"

├─132404 "php-fpm: pool 16351709215424"

├─132405 "php-fpm: pool 16351709215424"

├─132406 "php-fpm: pool 163595484830302"

├─132407 "php-fpm: pool 163595484830302"

├─132408 "php-fpm: pool 163595484830302"

├─132409 "php-fpm: pool 163620624410460"

├─132410 "php-fpm: pool 163620624410460"

├─132411 "php-fpm: pool 163620624410460"

├─132412 "php-fpm: pool 163620750817631"

├─132413 "php-fpm: pool 163620750817631"

├─132414 "php-fpm: pool 163620750817631"

├─132415 "php-fpm: pool 166853132123059"

├─132416 "php-fpm: pool 166853132123059"

├─132417 "php-fpm: pool 166853132123059"

├─132418 "php-fpm: pool 17676128142092182"

├─132419 "php-fpm: pool 17676128142092182"

├─132420 "php-fpm: pool 17676128142092182"

├─132422 "php-fpm: pool 17676224502138583"

├─132423 "php-fpm: pool 17676224502138583"

├─132424 "php-fpm: pool 17676224502138583"

├─132425 "php-fpm: pool 17676233702148934"

├─132426 "php-fpm: pool 17676233702148934"

├─132427 "php-fpm: pool 17676233702148934"

├─132428 "php-fpm: pool 17676246675678"

├─132429 "php-fpm: pool 17676246675678"

├─132430 "php-fpm: pool 17676246675678"

├─132432 "php-fpm: pool www"

├─132433 "php-fpm: pool www"

├─132434 "php-fpm: pool www"

├─132435 "php-fpm: pool www"

└─132436 "php-fpm: pool www"

Oct 22 13:53:37 ns1.example.com systemd[1]: Starting The PHP FastCGI Process Manager...

Oct 22 13:53:37 ns1.example.com php-fpm[132343]: [22-Oct-2026 13:53:37] NOTICE: PHP message: PHP Warning: Module "intl" is already loaded in Unknown on line 0

Oct 22 13:53:37 ns1.example.com php-fpm[132343]: [22-Oct-2026 13:53:37] NOTICE: PHP message: PHP Warning: Module "pspell" is already loaded in Unknown on line 0

Oct 22 13:53:37 ns1.example.com php-fpm[132343]: [22-Oct-2026 13:53:37] NOTICE: PHP message: PHP Warning: Module "zip" is already loaded in Unknown on line 0

Oct 22 13:53:38 ns1.example.com systemd[1]: Started The PHP FastCGI Process Manager.

Please advise.

Thank you.

Regards,

Mr. Turritopsis Dohrnii Teo En Ming

Republic of Singapore
22 Oct 2026 Thursday 7.47 pm Singapore Time
_______________________________________________
AlmaLinux Users mailing list -- users@lists.almalinux.org
To unsubscribe send an email to users-leave@lists.almalinux.org