Red Hat’s CVE-2026-109618 page describes an unauthenticated memory-corruption issue in PHP request parsing and rates it Important. Red Hat’s CVSS v3 score on that page is 8.1, with attack complexity High. NVD’s CVSS v3 score shown there is 9.8. PHP’s own score is CVSS v4.0 9.2. These are different scoring systems and different vendors. Use PHP’s score for upstream severity and Red Hat’s score for Red Hat’s products.
Red Hat says standard RHEL deployments use PHP-FPM rather than mod_php, and that FPM workers exit on early initialization failure, so remote code execution is harder and often needs application behavior. That matches the nuance in PHP’s FPM analysis. It is not an exemption from patching. PHP validated a separate FPM path for CVE-2026-109619.
The package matrix on the Red Hat page did not come through as a fixed-version list in this review. AlmaLinux, writing on 21 October 2026, said Red Hat had released a fix only for the RHEL 8 php:7.4 stream, package php-7.4.33-8.module_el8.10.0+4321+cf5fd4bb, and linked Red Hat bulletin RHSB-2026-013. Check that bulletin and the CVE page before you conclude other streams are still unfixed. The status can move in a day.
On RHEL, dnf update php* and a restart of php-fpm is the normal shape, followed by rpm -q. Because Red Hat backports, the upstream version in php -v can stay still. A scanner that wants 8.3.36 will false-positive a fixed backport. Prove the errata instead.
CentOS Stream and rebuilds are not automatically the same errata on the same hour. See the AlmaLinux and Rocky pages rather than assuming RHEL’s bulletin installed itself.