Patch the PHP runtime.

01 / Choose a fixed release

These are the first fixed upstream releases for both CVEs. Use a current security release on a supported branch. Distribution version strings can differ when fixes are backported.

Sources: PHP release advisory · Downloads

02 / Inventory the running application

Include public and internal PHP services, virtual hosts, FPM pools, containers, hosting panels, appliances, long-lived workers, and bundled PHP binaries. A host can run several independent versions.

php -v
php --ini
php -r 'printf("PHP=%s SAPI=%s\n", PHP_VERSION, PHP_SAPI);'

Map each web entry point to its serving process and installed package or container image. Check the vendor advisory for both CVE identifiers before choosing a candidate package.

03 / Install and replace workers

Use the package source or image pipeline you already trust. The examples below assume the named packages are already installed and the repository offers a fixed build. Adjust the branch and service names to your deployment.

# Check the candidate and its vendor security advisory first.
sudo apt-get update
apt-cache policy php8.4-fpm php8.4-cli

# Proceed once the candidate includes fixes for BOTH CVEs.
sudo apt-get install --only-upgrade php8.4-fpm php8.4-cli
sudo systemctl restart php8.4-fpm

# Review available packages and the vendor advisory first.
sudo dnf --refresh check-update 'php*'

# Proceed once the available build fixes BOTH CVEs.
sudo dnf upgrade 'php*'
sudo systemctl restart php-fpm

Install updates for every deployed PHP package and SAPI, not just the CLI. For Apache mod_php, update its PHP module package and restart Apache. A reverse proxy update alone does not update PHP-FPM.

Containers and embedded runtimes

Rebuild with a verified fixed PHP base or bundle, redeploy every replica, and drain old workers. Confirm the running image digest, not only the image tag. Apply the same process to FrankenPHP and LiteSpeed packages.

04 / Verify through the web SAPI

Use an existing private diagnostic or a temporary access-restricted endpoint to inspect the live runtime. Keep the endpoint unavailable to the public and remove it after verification.

<?php
// Serve only behind an existing admin-only access control.
header('Content-Type: application/json');
echo json_encode([
    'version' => PHP_VERSION,
    'sapi' => PHP_SAPI,
    'upload_progress' => ini_get('session.upload_progress.enabled'),
    'memory_limit' => ini_get('memory_limit'),
], JSON_PRETTY_PRINT), "\n";

• Compare the web runtime with the fixed release or the vendor’s backport advisory.
• Verify every pool, virtual host, and replica; one successful response does not cover a whole fleet.
• Confirm old workers have exited, then test normal application and upload flows.
• Record the package build or image digest and the advisory that confirms both fixes.

05 / End-of-life deployments

PHP 8.1 and earlier are outside normal upstream security support. Prefer migration to a supported branch. If a vendor supplies an LTS build, require explicit coverage for both CVEs.

PHP has published exceptional minimal source backports for 7.4, 8.0 and 8.1. They require a controlled build and validation process, and do not renew support. A community patch for upload-progress counters alone is not equivalent to the full upstream remediation.

Sources: PHP source backports · Support policy