To update your eLxr installations to upgrade your PHP stack to mitigate CVE-2026-109618 and -109619:
- eLxr 12 users should follow the instructions for “aria”
- eLxr 26.04.02 users should follow the instructions for “bianca.”
ARIA
Installing the php8.2 security fix (8.2.35-1~deb12u1) from aria-security
This installs the security-patched php8.2 (version 8.2.35-1~deb12u1, fixes the CRA-tracked CVEs) from the aria-security suite. By default. an aria system only has the base aria suite configured, which tops out at the vulnerable 8.2.32-1~deb12u1 — so the aria-security suite must be added first.
Run everything as root (or with sudo).
───────────────────────────────────────────────────────────────────────────────
eLxr aria — Community Edition (mirror.elxr.org)
Community edition uses the public mirror. No credentials needed. Note the flat URL layout: deb .
Back up your sources list
cp /etc/apt/sources.list /etc/apt/sources.list.bak.$(date +%F)
Add the aria-security suite (only if it's not already there)
grep -q 'aria-security' /etc/apt/sources.list || \ echo 'deb https://mirror.elxr.org/elxr aria-security main non-free-firmware' >> /etc/apt/sources.list
Your /etc/apt/sources.list should now contain three lines:
deb http://mirror.elxr.org/elxr aria main main-debian-community non-free-firmware non-free-firmware-debian-community contrib
deb http://mirror.elxr.org/elxr aria-updates main-debian-community main non-free-firmware contrib non-free-firmware-debian-community
deb http://mirror.elxr.org/elxr aria-security main-debian-community main non-free-firmware contrib non-free-firmware-debian-community
Update and install
apt-get update
apt-get install -y php8.2
Verify
apt-cache policy php8.2
(should reflect candidate 8.2.35-1~deb12u1 from packages.elxr.pro aria-security/main)
php -v
(should reflect version 8.2.35-1~deb12u1)
───────────────────────────────────────────────────────────────────────────────
eLxr aria — Pro Edition (packages.elxr.pro)
Pro is paywalled (HTTP Basic auth) and uses a per-suite URL-prefix layout — the suite name appears in both the URL path and the suite field:
deb https://packages.elxr.pro/aria-security aria-security main.
Substitute your real Pro entitlement credentials for YOUR_USER / YOUR_PASS.
Configure Pro credentials (apt reads these and sends them preemptively)
umask 077 cat > /etc/apt/auth.conf.d/elxr-pro.conf <<'EOF' machine packages.elxr.pro login YOUR_USER password YOUR_PASS EOF chmod 600 /etc/apt/auth.conf.d/elxr-pro.conf
Add the Pro sources
cat > /etc/apt/sources.list.d/elxr-pro.list <<'EOF'
deb https://packages.elxr.pro/aria aria main main-debian-community non-free-firmware non-free-firmware-debian-community contrib
deb https://packages.elxr.pro/aria-updates aria-updates main main-debian-community non-free-firmware non-free-firmware-debian-community contrib
deb https://packages.elxr.pro/aria-security aria-security main main-debian-community non-free-firmware non-free-firmware-debian-community contrib
EOF
Update and install
apt-get update
apt-get install -y php8.2
Verify
apt-cache policy php8.2
(should reflect candidate 8.2.35-1~deb12u1 from packages.elxr.pro aria-security/main
php -v
(should reflect version 8.2.35-1~deb12u1)
BIANCA
Update and install
apt-get update
apt-get install -y php8.4
The updated version should be 8.4.27-1~deb13u1 .