Debian 10 (buster) is not a supported Debian release, and the security tracker pages for both CVEs did not show a buster php package as fixed on 22 October 2026. This page will not invent a buster version number or tell you to enable a random archive.
PHP on Debian 10 is an old branch. The PHP project is not shipping a buster update. Extended support vendors such as Freexian may publish their own ELTS builds. If you pay for that service, use their advisory. If you do not, the practical options are to move the workload to Debian 12 or 13 and a fixed package, or to keep the host unreachable from the internet until that move is tested.
Identify the SAPI with apachectl -M and the FPM unit list. A local php -v of 7.3 does not tell you whether a third-party repository already replaced the binary. Read apt-cache policy before you conclude the only PHP on the box is Debian’s.
Consulting for this estate is a migration and exposure review. It is not a promise of an in-place Debian 10 security update from Debian itself.