Fix CVE-2026-109618 & CVE-2026-109619: Update PHP 7.4 to 7.4.3-4ubuntu2.29+esm5

On 21 October 2026, Ubuntu released security updates addressing two PHP vulnerabilities: CVE-2026-109618 and CVE-2026-109619. These issues involve memory handling and request state management and could allow a remote attacker to execute arbitrary code.

For PHP 7.4 on Ubuntu 20.04 LTS, the fixes are available through Ubuntu Pro, as detailed in Ubuntu Security Notice USN-8948-2. Use your Ubuntu Pro subscription token to attach the server before installing the updates. Keep your token private and never publish or commit it.

Steps to Enable Ubuntu Pro and Update PHP

Take a server snapshot and back up the database.
Update package lists:
```
sudo apt update
```
Install the Ubuntu Pro client:
```
sudo apt install ubuntu-pro-client
```
Check Ubuntu Pro status:
```
pro status
```
If the server is already attached, skip the next step.
Attach your Ubuntu Pro subscription:
```
sudo pro attach YOUR_SUBSCRIPTION_TOKEN
```
Replace YOUR_SUBSCRIPTION_TOKEN with the token from your Ubuntu Pro dashboard. Keep this token private.
Refresh package lists:
```
sudo apt update
```
Check the available PHP update:
```
apt-cache policy php7.4-common
```

Simulate the upgrade and review the proposed changes:

sudo apt-get -s install --only-upgrade \
  php7.4-common php7.4-cli libapache2-mod-php7.4

Install the PHP updates:

sudo apt-get install --only-upgrade \
  php7.4-common php7.4-cli libapache2-mod-php7.4

Test the Apache configuration:
```
sudo apache2ctl configtest
```
Restart Apache after the configuration test succeeds:
```
sudo systemctl restart apache2
```

Verify the installed package versions:

dpkg-query -W php7.4-common php7.4-cli libapache2-mod-php7.4

Test your production websites.

Check for Apache errors:

sudo tail -n 50 /var/log/apache2/error.log

Important: Run each command separately and review its output before continuing. Never share or commit your Ubuntu Pro subscription token.