Debian’s security tracker, opened on 22 October 2026, lists the same fixed packages for both CVEs.
| Suite | Source package | Fixed version | Status note |
|---|---|---|---|
| bookworm security | php8.2 | 8.2.35-1~deb12u1 | Fixed, DLA-4848-1 |
| bookworm | php8.2 | 8.2.32-1~deb12u1 | Marked vulnerable |
| trixie security | php8.4 | 8.4.27-1~deb13u1 | Fixed, DSA-6574-1 |
| sid | php8.4 | 8.4.27-1 | Fixed |
| forky | php8.4 | 8.4.26-1 | Marked vulnerable |
The tracker page did not list a fixed package for Debian 11 or Debian 10. Do not infer one. Unstable’s php8.2 line was marked unfixed in the tracker’s second table while bookworm’s php8.2 security build was fixed. Suite matters.
Install from the security archive after apt update, then compare apt-cache policy output with the tracker row for your suite. Restart php-fpm or Apache. Recheck the tracker the same day, because a later revision can supersede 8.2.35-1~deb12u1.
Debian’s default integration for current releases is PHP-FPM behind the web server. Confirm that with the module list before you restart only the wrong daemon. Legacy mod_php hosts still exist and are the higher-risk SAPI in PHP’s advisory.