This review did not open a Rocky Linux errata that names CVE-2026-109618 or CVE-2026-109619. AlmaLinux published its own package list. Those NEVRAs are not instructions for Rocky. The projects rebuild related sources and they do not publish identical timestamps.
Check Rocky’s errata or dnf updateinfo for both CVE IDs on the day you patch. If a fixed build is listed, install it and restart php-fpm, or httpd if you deliberately enabled mod_php. Confirm with rpm -q, not with the upstream version alone.
If Rocky has not shipped your stream yet, the temporary PHP settings and, for internet-facing high-value apps, network isolation are the interim controls PHP and CISA described. Switching the machine to AlmaLinux packages to borrow a version string is a distribution change, not a one-line fix, and this site does not recommend it as a casual step.
Module streams still matter. dnf module list php shows which stream is enabled. Resetting a module to a newer stream is an application compatibility change and needs a staging test.