This is the usual production layout: Nginx in front, one or more PHP-FPM pools behind a socket. The vulnerable code is inside the pool’s PHP binary.

Map the trust boundary

  1. Open the Nginx server block for the hostname.
  2. Record fastcgi_pass. A Unix socket stays on the machine. A TCP port can point at another host, and that host is the one you have to patch.
  3. Open the matching pool. Note the user and the versioned path of the pool directory.
  4. Run that version’s php-fpm binary with -v, and also read the package metadata. They answer different questions when a vendor backports.

Patch

Install the fixed build for that exact branch. Ubuntu 24.04’s php8.3 fix does not update a php8.1-fpm pool. Debian 12’s php8.2 security update does not update a manually compiled 8.1 in /usr/local.

Restart

Restart the FPM service, not only Nginx. If you run several versioned units, restart each unit whose socket is still referenced. Old workers keep the old text segment until they exit. A graceful Nginx reload will not recycle them.

Multiple pools

One site can send /index.php to 8.3 and a legacy subdirectory to 7.4. Both need a decision. The 7.4 decision may be a vendor backport or a migration, because 7.4 has a source backport and no upstream tag.

What remains risky

PHP-FPM is still susceptible to CVE-2026-109619 through session upload progress when the application has a failing operation the attacker can reach. Setting session.upload_progress.enabled=0 in the pool, with php_admin_value so the app cannot flip it back, reduces that confirmed path. It is not the patch.

Sources checked