Remi repository releases PHP updates fixing critical security bugs

Brief written by the FOSSWire AI editor from Planet Fedora How we write

October 22, 2026 1 min read

Key Takeaway

New PHP RPMs for versions 8.2, 8.3, 8.4, and 8.5 address two critical security vulnerabilities.

Summary

Remi Collet has released updated RPM packages for multiple PHP versions in the remi-modular repository. These updates for PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 are intended for Fedora and Enterprise Linux users to address two critical security vulnerabilities (CVE-2026-109618 and CVE-2026-109619).

Technical details of the PHP update

Fixes critical security bugs CVE-2026-109618 and CVE-2026-109619.
Available for x86_64 and aarch64 architectures.
The intl extension now utilizes libicu74 (version 74.2).
The mbstring extension on EL builds now uses oniguruma5php (version 6.9.10).
The oci8 extension uses Oracle Instant Client version 23.26.
PHP 8.1 has reached end of life and is no longer maintained.

Why it matters

Users running PHP 8.2 through 8.5 on Fedora or RHEL-based distributions should update immediately to mitigate the identified critical vulnerabilities.

What to do

Fedora and Enterprise Linux users should update to PHP versions 8.2.35, 8.3.36, 8.4.27, or 8.5.12 to fix critical security vulnerabilities.
On Enterprise Linux, use 'dnf module switch-to php:remi-[version]/common' to replace the default PHP installation.
On Fedora, use 'dnf module reset php', 'dnf module enable php:remi-[version]', and 'dnf update' to replace the default PHP installation.

Original reference: blog.remirepo.net →