Arch Calls for PHP and Certificate Updates: Two Risks, Different Checks

Arch Linux issued two security warnings on October 21: one for PHP installations exposed to the internet and another for the system's Mozilla certificate bundle. They concern different risks. Updating a PHP service does not settle the certificate issue, and a machine without PHP may still need the trust-bundle update.

Start with the installed packages

The PHP notice identifies CVE-2026-109618 and CVE-2026-109619 as remote-code-execution vulnerabilities. Arch urges immediate upgrades for systems publicly exposing PHP applications on an affected version. It gives these minimum fixed versions:

• php: 8.5.12.
• php-legacy: 8.3.36.
• ca-certificates-mozilla: 3.131.1-1, for the separate certificate issue.

The two PHP package names matter. Check the branch your service actually uses rather than assuming an updated primary package also replaces a legacy installation. The notice does not claim that every Arch desktop has a publicly reachable PHP application; exposure and the installed runtime are part of assessing that particular warning.

The certificate warning reaches a different layer

In its second announcement, Arch says several eMudhra intermediate-certificate-authority certificates were revealed as compromised on October 20. The updated ca-certificates-mozilla bundle removes or invalidates the affected certificates.

Arch warns that systems retaining the older central bundle are susceptible to man-in-the-middle attacks. This is a trust-data update, rather than a new PHP runtime. A server administrator who checks only the PHP version could therefore overlook another item in the same day's security notices. Equally, not running a website does not make the bundle irrelevant to a machine that uses it.

Apply a full upgrade, then check running services

Arch's system-maintenance guidance recommends full upgrades and explicitly rejects partial upgrades. After reviewing the current news and preparing backups, use the normal full-system update:

sudo pacman -Syu

Review package-manager messages and confirm the installed versions afterward. If the update fails after refreshing the package database, resolve that failure and complete the upgrade before carrying out other package operations. Downloading a replacement package is not the same as successfully installing it.

There is one more check for a running PHP deployment. The ArchWiki notes that upgrades generally do not update processes already in memory. Restart affected services according to the deployment, or reboot where appropriate, and verify the application still works.

Our October installation-image report explains the other common source of confusion: existing Arch users follow the rolling repositories. A monthly ISO is an installation snapshot, not a substitute for today's package updates.