PHP’s advisory says the risk is highest for Apache mod_php. Complete remote code execution for CVE-2026-109618 was validated against mod_php with default limits, before application code, on prefork with multiple workers. CVE-2026-109619’s fatal backtrace path on PHP 8.5 and the session upload progress path were also demonstrated against mod_php.
Confirm the layout:
apachectl -M | grep -E 'php|mpm_'
php_module plus mpm_prefork_module is the embedded interpreter. AlmaLinux notes that AlmaLinux 8 still ships mod_php and that it loads only when Apache has been switched to prefork. AlmaLinux 9 and 10 do not ship mod_php. Other distributions differ. Read your own module list.
The package you update is the Apache PHP module package, often libapache2-mod-php* on Debian and Ubuntu or php on older RHEL builds. Updating a php-fpm package on a server that never uses FPM does not change mod_php.
Restart Apache after the install so the module is unmapped and loaded again. A graceful reload is distribution-specific. For a security fix, a full restart is the check that old children are gone. Plan it, because in-flight requests end.
Review .htaccess and php_admin_value entries. They are part of the CVE-2026-109619 consumer on mod_php. Removing obsolete directives is useful and still not a substitute for the patched module.
If the application can run under PHP-FPM, moving off mod_php removes the pre-application path PHP demonstrated. That move is a configuration project. Do it after the current module is patched, or instead of waiting, not as a reason to delay a package you can install today.