On 22 October 2026 the Debian tracker marked bookworm’s php8.2 security build 8.2.35-1deb12u1 as fixed for both CVEs, origin DLA-4848-1. The bookworm suite build 8.2.32-1deb12u1 was still marked vulnerable. Installing “whatever bookworm has” without the security archive is the failure mode.
apt update
apt-cache policy php8.2-fpm php8.2-cli libapache2-mod-php8.2
Install the fixed version for the packages you actually have, from Debian’s security repository. Then restart php8.2-fpm, or apache2 if libapache2-mod-php8.2 is loaded. Check policy again and confirm the candidate you installed is the security revision or a newer one the tracker has since marked fixed.
Debian 12’s default web path is PHP-FPM. A machine that also has a locally compiled PHP in /usr/local is not fixed by this package. The vhost’s socket has to point at Debian’s pool.
PHP 8.2 security support ends on 31 December 2026. Bookworm will need a later Debian decision for life after that date. This update solves the two CVEs. It does not extend the upstream 8.2 calendar.