Hi,

I have the patched PHP packages for AlmaLinux 9.8.

[root@ns1 ~]# rpm -qa | grep php | grep 8.0.30-8.el9_8.alma.1
php-common-8.0.30-8.el9_8.alma.1.x86_64
php-pdo-8.0.30-8.el9_8.alma.1.x86_64
php-mysqlnd-8.0.30-8.el9_8.alma.1.x86_64
php-cli-8.0.30-8.el9_8.alma.1.x86_64
php-fpm-8.0.30-8.el9_8.alma.1.x86_64
php-gd-8.0.30-8.el9_8.alma.1.x86_64
php-intl-8.0.30-8.el9_8.alma.1.x86_64
php-mbstring-8.0.30-8.el9_8.alma.1.x86_64
php-opcache-8.0.30-8.el9_8.alma.1.x86_64
php-process-8.0.30-8.el9_8.alma.1.x86_64
php-xml-8.0.30-8.el9_8.alma.1.x86_64

Thank you.

Regards,

Mr. Turritopsis Dohrnii Teo En Ming
Republic of Singapore
22 Oct 2026 Thursday 11.42 pm Singapore Time


On Thursday, 22 October 2026 at 11:24 PM, Turritopsis Dohrnii Teo En Ming <sgptem@protonmail.com> wrote:
Hi,

Thank you for the information.

I will check my AlmaLinux 9.8 server for the patched version of PHP.

Regards,

Mr. Turritopsis Dohrnii Teo En Ming
Republic of Singapore
22 Oct 2026 Thursday 11.23 pm Singapore Time


On Thursday, 22 October 2026 at 11:13 PM, Francesco Di Nucci <francesco.dinucci@na.infn.it> wrote:

The Alma blog post (https://almalinux.org/blog/2026-10-21-php2shell-cve-2026-109618-cve-2026-109619/) lists the package versions with the fixes (quote below).

Check the package versions and eventually update:

AlmaLinux 8

php:7.2 stream: php-7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1
php:7.3 stream: php-7.3.20-1.module_el8.10.0+4316+90ea5fe5.alma.1
php:7.4 stream: php-7.4.33-8.module_el8.10.0+4321+cf5fd4bb (Red Hat’s update, released directly to production)
php:8.0 stream: php-8.0.30-1.module_el8.10.0+4319+26f10322.alma.1
php:8.2 stream: php-8.2.33-1.module_el8.10.0+4320+c30d6dbb.alma.1

AlmaLinux 9

Default (PHP 8.0): php-8.0.30-8.el9_8.alma.1
php:8.1 stream: php-8.1.32-1.module_el9.8.0+326+528679fc.alma.1
php:8.2 stream: php-8.2.33-1.module_el9.8.0+327+37dfd4b4.alma.1
php:8.3 stream: php-8.3.33-1.module_el9.8.0+328+1fdeb728.alma.1

AlmaLinux 10

Default (PHP 8.3): php-8.3.33-1.el10_2.alma.1
PHP 8.4 (php8.4 packages): php8.4-8.4.24-1.el10_2.alma.1

AlmaLinux Kitten 10

The fix will ride along in the next regular PHP update, so no separate build is being made.

--
Francesco Di Nucci
System Administrator
Compute & Networking Service, INFN Naples

Email: francesco.dinucci@na.infn.it
On 22/10/26 15:23, Turritopsis Dohrnii Teo En Ming via AlmaLinux Users wrote:
Subject: PHP security vulnerabilities on my AlmaLinux 9.8

Good day from Singapore,

Can I check and confirm with you whether the PHP security vulnerabilities disclosed on 21 Oct 2026 have been fixed in my AlmaLinux 9.8?

[root@ns1 ~]# cat /etc/os-release
NAME="AlmaLinux"
VERSION="9.8 (Olive Jaguar)"
ID="almalinux"
ID_LIKE="rhel centos fedora"
VERSION_ID="9.8"
PLATFORM_ID="platform:el9"
PRETTY_NAME="AlmaLinux 9.8 (Olive Jaguar)"
ANSI_COLOR="0;34"
LOGO="fedora-logo-icon"
CPE_NAME="cpe:/o:almalinux:almalinux:9::baseos"
DOCUMENTATION_URL="https://wiki.almalinux.org/"

ALMALINUX_MANTISBT_PROJECT="AlmaLinux-9"
ALMALINUX_MANTISBT_PROJECT_VERSION="9.8"
REDHAT_SUPPORT_PRODUCT="AlmaLinux"
REDHAT_SUPPORT_PRODUCT_VERSION="9.8"
SUPPORT_END=2032-06-01
[root@ns1 ~]# rpm -qa | grep -i '^php'
php-pecl-zip-1.19.2-6.el9.x86_64
php-pear-1.10.14-1.el9.noarch
php-pspell-8.0.30-3.el9.x86_64
php-common-8.0.30-8.el9_8.alma.1.x86_64
php-pdo-8.0.30-8.el9_8.alma.1.x86_64
php-mysqlnd-8.0.30-8.el9_8.alma.1.x86_64
php-cli-8.0.30-8.el9_8.alma.1.x86_64
php-fpm-8.0.30-8.el9_8.alma.1.x86_64
php-gd-8.0.30-8.el9_8.alma.1.x86_64
php-intl-8.0.30-8.el9_8.alma.1.x86_64
php-mbstring-8.0.30-8.el9_8.alma.1.x86_64
php-opcache-8.0.30-8.el9_8.alma.1.x86_64
php-process-8.0.30-8.el9_8.alma.1.x86_64
php-xml-8.0.30-8.el9_8.alma.1.x86_64
[root@ns1 ~]# dnf updateinfo list --security
Last metadata expiration check: 2:09:59 ago on Thu 22 Oct 2026 11:46:51 AM +08.
[root@ns1 ~]# dnf updateinfo info --cve CVE-2026-109618
Last metadata expiration check: 2:10:22 ago on Thu 22 Oct 2026 11:46:51 AM +08.

[root@ns1 ~]# dnf updateinfo info --cve CVE-2026-109619
Last metadata expiration check: 2:10:35 ago on Thu 22 Oct 2026 11:46:51 AM +08.

[root@ns1 ~]# systemctl status httpd
● httpd.service - The Apache HTTP Server
Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; preset: disabled)
Drop-In: /usr/lib/systemd/system/httpd.service.d
└─php-fpm.conf
Active: active (running) since Thu 2026-10-22 07:18:37 +08; 6h ago
Main PID: 1081 (httpd)
Status: "Total requests: 2945; Idle/Busy workers 100/0;Requests/sec: 0.123; Bytes served/sec: 1.5KB/sec"
Tasks: 231 (limit: 74628)
Memory: 54.8M (peak: 56.5M)
CPU: 45.196s
CGroup: /system.slice/httpd.service
├─1081 /usr/sbin/httpd -DFOREGROUND
├─1183 /usr/sbin/httpd -DFOREGROUND
├─1188 /usr/sbin/httpd -DFOREGROUND
├─1194 /usr/sbin/httpd -DFOREGROUND
├─1212 /usr/sbin/httpd -DFOREGROUND
├─1224 /usr/sbin/httpd -DFOREGROUND
└─7507 /usr/sbin/httpd -DFOREGROUND

Oct 22 07:18:37 ns1.example.com systemd[1]: Starting The Apache HTTP Server...
Oct 22 07:18:37 ns1.example.com systemd[1]: Started The Apache HTTP Server.
Oct 22 07:18:37 ns1.example.com httpd[1081]: Server configured, listening on: port 443, port 80
[root@ns1 ~]# systemctl status php-fpm
● php-fpm.service - The PHP FastCGI Process Manager
Loaded: loaded (/usr/lib/systemd/system/php-fpm.service; enabled; preset: disabled)
Drop-In: /etc/systemd/system/php-fpm.service.d
└─00-virtualmin.conf
Active: active (running) since Thu 2026-10-22 13:53:38 +08; 4min 23s ago
Main PID: 132343 (php-fpm)
Status: "Processes active: 0, idle: 35, Requests: 0, slow: 0, Traffic: 0req/sec"
Tasks: 36 (limit: 74628)
Memory: 39.1M (peak: 39.8M)
CPU: 495ms
CGroup: /system.slice/php-fpm.service
├─132343 "php-fpm: master process (/etc/php-fpm.conf)"
├─132400 "php-fpm: pool 163465190630155"
├─132401 "php-fpm: pool 163465190630155"
├─132402 "php-fpm: pool 163465190630155"
├─132403 "php-fpm: pool 16351709215424"
├─132404 "php-fpm: pool 16351709215424"
├─132405 "php-fpm: pool 16351709215424"
├─132406 "php-fpm: pool 163595484830302"
├─132407 "php-fpm: pool 163595484830302"
├─132408 "php-fpm: pool 163595484830302"
├─132409 "php-fpm: pool 163620624410460"
├─132410 "php-fpm: pool 163620624410460"
├─132411 "php-fpm: pool 163620624410460"
├─132412 "php-fpm: pool 163620750817631"
├─132413 "php-fpm: pool 163620750817631"
├─132414 "php-fpm: pool 163620750817631"
├─132415 "php-fpm: pool 166853132123059"
├─132416 "php-fpm: pool 166853132123059"
├─132417 "php-fpm: pool 166853132123059"
├─132418 "php-fpm: pool 17676128142092182"
├─132419 "php-fpm: pool 17676128142092182"
├─132420 "php-fpm: pool 17676128142092182"
├─132422 "php-fpm: pool 17676224502138583"
├─132423 "php-fpm: pool 17676224502138583"
├─132424 "php-fpm: pool 17676224502138583"
├─132425 "php-fpm: pool 17676233702148934"
├─132426 "php-fpm: pool 17676233702148934"
├─132427 "php-fpm: pool 17676233702148934"
├─132428 "php-fpm: pool 17676246675678"
├─132429 "php-fpm: pool 17676246675678"
├─132430 "php-fpm: pool 17676246675678"
├─132432 "php-fpm: pool www"
├─132433 "php-fpm: pool www"
├─132434 "php-fpm: pool www"
├─132435 "php-fpm: pool www"
└─132436 "php-fpm: pool www"

Oct 22 13:53:37 ns1.example.com systemd[1]: Starting The PHP FastCGI Process Manager...
Oct 22 13:53:37 ns1.example.com php-fpm[132343]: [22-Oct-2026 13:53:37] NOTICE: PHP message: PHP Warning: Module "intl" is already loaded in Unknown on line 0
Oct 22 13:53:37 ns1.example.com php-fpm[132343]: [22-Oct-2026 13:53:37] NOTICE: PHP message: PHP Warning: Module "pspell" is already loaded in Unknown on line 0
Oct 22 13:53:37 ns1.example.com php-fpm[132343]: [22-Oct-2026 13:53:37] NOTICE: PHP message: PHP Warning: Module "zip" is already loaded in Unknown on line 0
Oct 22 13:53:38 ns1.example.com systemd[1]: Started The PHP FastCGI Process Manager.

Please advise.

Thank you.

Regards,

Mr. Turritopsis Dohrnii Teo En Ming
Republic of Singapore
22 Oct 2026 Thursday 7.47 pm Singapore Time


_______________________________________________
AlmaLinux Users mailing list -- users@lists.almalinux.org
To unsubscribe send an email to users-leave@lists.almalinux.org