Ubuntu’s post on 21 October 2026 says fixes are available for the php packages on supported releases, with CVSS 4.0 9.2 for both CVEs. The package table is:
| Ubuntu release | Package | Fixed in |
|---|---|---|
| 14.04 ESM | php5 | 5.5.9+dfsg-1ubuntu4.29+esm18 |
| 16.04 ESM | php7.0 | 7.0.33-0ubuntu0.16.04.16+esm22 |
| 18.04 ESM | php7.2 | 7.2.24-0ubuntu0.18.04.17+esm14 |
| 20.04 ESM | php7.4 | 7.4.3-4ubuntu2.29+esm5 |
| 22.04 | php8.1 | 8.1.2-1ubuntu2.28 |
| 24.04 | php8.3 | 8.3.6-0ubuntu0.24.04.13 |
| 26.04 | php8.5 | 8.5.4-0ubuntu1.5 |
| 26.10 | php8.5 | 8.5.9-0ubuntu2.1 |
Ubuntu says 26.10, 26.04, 24.04, and 22.04 receive the fixes in standard support. 20.04 and 18.04 need Ubuntu Pro ESM. 16.04 and 14.04 need ESM with the legacy add-on. This site is not Ubuntu and does not sell that subscription. The package will not appear if the entitlement is missing.
The check Ubuntu published is:
apt list '?installed ?name(^php[0-9.]+$)'
Upgrade with apt update and apt upgrade, or the only-upgrade name pattern in their post. Then restart the service that embeds PHP. Ubuntu’s example is systemctl restart apache2 for mod_php. PHP-FPM needs its own unit restarted. unattended-upgrades may install the deb and still leave old workers running.
Most of these fixes keep the old upstream version. php -v on Ubuntu 24.04 can keep saying 8.3.6 after a successful patch. Compare the full deb version with the table.