alt Hacker Newsat 15:00 UTC, spot checking, Debian 13 has a fix, Ubuntu 26.04 has a fix with their own patch version number, Fedora does not.
Ubuntu: https://ubuntu.com/security/notices/USN-8948-1
Fedora package status: https://packages.fedoraproject.org/pkgs/php/php-fpm/
PHP 8.5.4-0ubuntu1.5 (the fixed version for Ubuntu 26.04) has been downloadable for me via apt from security.ubuntu.com for about 30 minutes. Perhaps check to see that you're not using a different mirror?