Fedora ships current PHP branches and moves quickly. This review did not record a Fedora advisory or a bodhi update ID for these CVEs, so no Fedora package version is stated here. Third-party status pages disagreed with vendor blogs during the first day of this incident. The Fedora update should be read from Fedora.
Use dnf updateinfo or the Fedora advisory site for CVE-2026-109618 and CVE-2026-109619. Install the build they mark fixed. Restart php-fpm. Fedora systems are often the place people run the newest branch, including pre-release PHP. A PHP 8.6 release candidate is not the production fix. Use a stable branch build the advisory names.
If you installed PHP from a upstream tarball to test a release candidate, that tree is invisible to dnf. Replace it deliberately or stop serving traffic with it.
The same SAPI rules apply: mod_php if loaded, otherwise the FPM unit. Fedora’s default is FPM.