Pick the remediation that matches the PHP you actually run. Do this on a staging copy first when the application is business-critical, and keep a way back to the previous package.
Supported upstream branches
Move PHP 8.2 to 8.2.35 or newer, 8.3 to 8.3.36 or newer, 8.4 to 8.4.27 or newer, and 8.5 to 8.5.12 or newer. PHP 8.2’s security support ends on 31 December 2026, so an 8.2.35 update still leaves a short runway.
If you install distribution packages, install the version named in that distribution’s advisory. Ubuntu’s post shows:
sudo apt update && sudo apt upgrade
Restart Apache if you use mod_php, and restart the PHP-FPM service if the vhost uses FPM. Ubuntu notes that unattended-upgrades can install the package and that the application still needs a restart.
On AlmaLinux, the vendor’s command is dnf upgrade ‘php*’ followed by a restart of php-fpm, or httpd when AlmaLinux 8 is actually running mod_php.
On Debian, install the security-archive package listed by the tracker. For bookworm that was php8.2 8.2.35-1~deb12u1 on 22 October 2026. Confirm the tracker still names the version you are about to install.
End-of-life branches
PHP 8.1, 8.0, and 7.4 have source backports and no tagged release. Prefer a vendor package that names both CVEs. A custom build from the published branch is for teams that already build PHP and can rebuild extensions.
PHP 5.6 and the 7.0 through 7.3 line are not in PHP’s source-backport list. Some vendors, including Ubuntu ESM for specific older releases, published packages anyway. If your vendor has not, the honest options are a tested migration to a fixed supported release, or isolation until that migration exists. A php.ini change does not finish the job.
After the install
Confirm the running worker, not the package cache. Watch the service log for modules that failed to load. Run the application checks you already trust. Keep the previous package or image until those checks pass.
If the change cannot happen now, use the temporary mitigations and treat them as a timer, not a close.
Questions
Can I fix this with a WAF rule only?
No. PHP says the update is the only complete fix. A WAF is a temporary reduction of exposure.