PHP’s CVE-2026-109618 advisory says LSAPI models FPM. Application-specific exploitation is considered likely and was not validated as a complete exploit in that advisory. CVE-2026-109619 says LSAPI can apply special environment INI values early and is a conditional candidate. That is enough to patch. It is not a claim that a public LiteSpeed exploit was published by PHP.
LiteSpeed PHP is often a separate build from the operating system php package, especially under cPanel, Plesk, or a vendor repository. Updating Debian’s php8.2 package does nothing to /usr/local/lsws/lsphp if that is the handler the vhost uses.
In the LiteSpeed admin or the Apache-compatible config, find the script handler for php and the external app definition. Note the command path. Run that binary with -v and, if it came from a package, query that package. Then install the build your LiteSpeed vendor marks as containing both CVEs. This review did not confirm a LiteSpeed package version on 22 October 2026, so the version has to come from LiteSpeed or your panel vendor.
Restart the LiteSpeed PHP external application so old lsphp processes exit. A detached worker from before the binary replacement is still the old code.
If the handler is switched per vhost, repeat the check for each PHP version the panel offers. A “default” of 8.3 does not fix a site pinned to 7.4.