Debian 13 trixie uses php8.4. The tracker listed 8.4.27-1~deb13u1 in trixie-security as fixed for both CVEs, origin DSA-6574-1. The upstream fixed release is also 8.4.27, so the Debian version and the upstream version line up more closely than Ubuntu’s 8.3 backport does. You still want the Debian revision, not a tarball dropped over the packaged modules.
Update apt, install the security build of the php8.4 SAPI packages you use, and restart php8.4-fpm or Apache if the module is loaded. forky’s 8.4.26-1 was still marked vulnerable on the same tracker page. A host that has been pointed at forky early should not assume it inherited the trixie fix.
Confirm the running pool with systemctl status php8.4-fpm and a request to the site. If you also installed php8.2 from an older template, that second package is outside this trixie row and needs its own check.