Many current Apache setups do not embed PHP. They proxy to PHP-FPM with proxy_fcgi. The CVE still lives in the FPM workers. Apache’s own package is the wrong thing to declare “patched” if the pool is old.
Look for SetHandler or ProxyPass matching proxy:unix or fcgi://. The socket path identifies the pool. Debian and Ubuntu often use /run/php/php8.3-fpm.sock. A panel may use a per-user socket under /opt or /var.
Patch the PHP build for that socket. Restart the php-fpm unit. Restarting apache2 is still worth doing if you changed proxy configuration, and it is not the step that replaces the FPM binary.
FPM exposure to CVE-2026-109619 includes session upload progress by default, and a conditional early INI path when Apache sends PHP_VALUE parameters. .user.ini is applied later and is not that early consumer. Do not spend the maintenance window only deleting .user.ini.
If several virtual hosts use different sockets, list them before the window. A forgotten php7.4-fpm service is still a public bug if any vhost points at it. Legacy consulting on this site is often exactly that inventory: which vhost still needs 7.4, and whether a vendor package exists for it.