# Remi repository releases PHP updates fixing critical security bugs

> **Key takeaway:** New PHP RPMs for versions 8.2, 8.3, 8.4, and 8.5 address two critical security vulnerabilities.

**Published:** 2026-10-22T12:58:00+00:00 
**Source:** Planet Fedora 
**Category:** distro-planet 
**Canonical URL:** https://fosswire.org/news/remi-repository-releases-php-updates-fixing-critical-securit.html 

## Summary
Remi Collet has released updated RPM packages for multiple PHP versions in the remi-modular repository. These updates for PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 are intended for Fedora and Enterprise Linux users to address two critical security vulnerabilities (CVE-2026-109618 and CVE-2026-109619).

## Technical details of the PHP update
- Fixes critical security bugs **CVE-2026-109618** and **CVE-2026-109619**.
- Available for **x86_64** and **aarch64** architectures.
- The **intl** extension now utilizes **libicu74** (version 74.2).
- The **mbstring** extension on EL builds now uses **oniguruma5php** (version 6.9.10).
- The **oci8** extension uses **Oracle Instant Client** version 23.26.
- PHP 8.1 has reached end of life and is no longer maintained.

## Why it matters
Users running PHP 8.2 through 8.5 on Fedora or RHEL-based distributions should update immediately to mitigate the identified critical vulnerabilities.