Urgent PHP CVE Security Patch

I’m running a production-level VPS in the cloud on Ubuntu / Debian and have just been alerted to the new PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619. I need them closed immediately.

You’ll receive full SSH access with administrator privileges the moment we start. I’ve already arranged a snapshot backup, so you can focus on:

• Upgrading or hot-patching PHP to the secure version that eliminates both CVEs
• Verifying that all existing virtual hosts and extensions continue to load without errors
• Providing a brief post-upgrade report that lists the exact package versions applied and the commands executed so I can reproduce the fix on staging

Downtime has to be kept to an absolute minimum, and I’d like the patch applied during the next maintenance window if possible (or sooner if you’re confident in zero-downtime techniques like PHP-FPM socket switching).

If this is routine work for you and you’re comfortable on Ubuntu/Debian with apt, make alt-install, or recompilation approaches, let’s get this wrapped up today.