On 10-21-2026 two of the largest vulnerabilities in the history of the internet were disclosed. CVE-2026-109619 and CVE-2026-109618. Here’s how we patched our SmartVPSs that are based on AlmaLinux9 using the Remi PHP RPM repository.

Note: If your server isn’t using Remi’s Repo, these instructions will not work

Here’s the command (oh yeah, its sooo easy). Run as root our use sudo:

yum update

===== PHP 74 =====
php74-php-common-7.4.33-31.el9.remi.x86_64
* Wed Oct 21 2026 Remi Collet <remi@remirepo.net> - 7.4.33-31
- Mitigation fix Avoid state corruption via bailout
  CVE-2026-109618, CVE-2026-109619

===== PHP 80 =====
php80-php-common-8.0.30-21.el9.remi.x86_64
* Wed Oct 21 2026 Remi Collet <remi@remirepo.net> - 8.0.30-21
- Mitigation fix Avoid state corruption via bailout
  CVE-2026-109618, CVE-2026-109619

===== PHP 81 =====
php81-php-common-8.1.34-6.el9.remi.x86_64
* Wed Oct 21 2026 Remi Collet <remi@remirepo.net> - 8.1.34-6
- Mitigation fix Avoid state corruption via bailout
  CVE-2026-109618, CVE-2026-109619

Press y to confirm that you’d like these updates to be applied to your system. The output will likely have a newer versions of PHP if that’s what you are running.

Then wait a good long while for the packages to update as the repos are understandably currently bogged down while the masses are attempting to update their servers.

And that’s it!

Thank you Remi for your quick work!