# SC-002 transcript. Commands run in throwaway Docker containers (arm64). Raw output, unedited except
# that the Ubuntu changelog lines come from a second run of the same image (changelog file on disk).
# Rocky: dnf updateinfo printed no advisory rows for the CVE id; the changelog entry is a plain rebase.

=== ubuntu:24.04 ===
$ php -v
PHP 8.3.6 (cli) (built: Oct 19 2026 15:16:58) (NTS)
$ dpkg -l php8.3-cli
ii  php8.3-cli     8.3.6-0ubuntu0.24.04.13 arm64        command-line interpreter for the PHP scripting language
$ apt-get changelog php8.3-cli   # network changelog service returned 404 for this build at capture time
E: Failed to fetch https://changelogs.ubuntu.com/changelogs/pool/main/p/php8.3/php8.3_8.3.6-0ubuntu0.24.04.13/changelog  Changelog unavailable (404 Not Found)
$ zcat /usr/share/doc/php8.3-cli/changelog.Debian.gz | grep -E CVE-2026-10961[89] | head -3
    - debian/patches/CVE-2026-109618_109619.patch: Avoid state corruption via
    - CVE-2026-109618
    - CVE-2026-109619
$ apt-cache policy php8.3-cli
php8.3-cli:
  Installed: 8.3.6-0ubuntu0.24.04.13
  Candidate: 8.3.6-0ubuntu0.24.04.13
  Version table:
 *** 8.3.6-0ubuntu0.24.04.13 500
        500 http://ports.ubuntu.com/ubuntu-ports noble-updates/main arm64 Packages
        500 http://ports.ubuntu.com/ubuntu-ports noble-security/main arm64 Packages
        100 /var/lib/dpkg/status

=== rockylinux:9 ===
$ php -v
PHP 8.3.36 (cli) (built: Oct 19 2026 14:00:34) (NTS gcc aarch64)
$ rpm -q php-cli
php-cli-8.3.36-1.module+el9.8.0+40396+4e680bb7.aarch64
$ dnf updateinfo list --cve CVE-2026-109618
Last metadata expiration check: 0:00:03 ago on Fri Oct 23 08:35:27 2026.
$ rpm -q --changelog php-cli | grep CVE-2026-10961
(none)
$ rpm -q --changelog php-cli | head -3
* Tue Oct 20 2026 Jitka Plesnikova <jplesnik@redhat.com> - 8.3.36-1
- rebase to 8.3.36