Debian 11 (bullseye) did not appear in the fixed-package tables for CVE-2026-109618 or CVE-2026-109619 when those tracker pages were reviewed on 22 October 2026. Debian 11’s usual PHP package is php7.4, and 7.4 has an upstream source backport rather than a tag. That source branch is not the same thing as a Debian security update.
Check the tracker again before you act. If a bullseye advisory appears later, use that version. If it does not, do not backport the bookworm package name 8.2.35-1~deb12u1 onto bullseye. The correct moves are a planned upgrade to Debian 12 or 13, a vendor ELTS package you have actually subscribed to, or a source build you are prepared to maintain.
Restart targets are the same as on newer Debian: the FPM unit for the pool the vhost uses, or Apache if mod_php is loaded. Confirm which one with the module list. Many bullseye WordPress hosts are FPM. Some older panels are not.
Until the runtime changes, apply PHP’s temporary settings and consider removing the site from the public network if the data is sensitive. CISA’s alert used that offline option for PHP that cannot be updated.