How to update PHP on RHEL, AlmaLinux and Rocky Linux

Five dnf steps

Update PHP with dnf in five steps

The same commands work on RHEL, AlmaLinux and Rocky Linux. Where an advisory ID appears, use the ALSA or RLSA prefix on the rebuilds.

1. 1

   Work out which PHP you run

   # RHEL 8 and 9: which php stream is enabled [e] and installed [i]
   dnf module list php
   
   # Any release: the PHP packages on the system
   dnf list --installed 'php*'

   The module list marks streams [d] for default, [e] for enabled, [x] for disabled and [i] for installed. No stream enabled on RHEL 9 means the plain PHP 8.0 package. RHEL 10 has no streams, so look for php8.4 in the package names instead.

2. 2

   Find the advisory for your stream

   sudo dnf updateinfo list updates security
   sudo dnf updateinfo info --cve CVE-2026-109618

   The first command lists security advisories with packages ready to install; the second shows the advisory that fixes a given CVE. If nothing PHP-related appears, your stream may be retired: see changing stream.

3. 3

   Install the update

   # Every pending security fix
   sudo dnf update --security
   
   # Or only the PHP advisory (RHEL 9, php:8.3 stream in this example)
   sudo dnf update --advisory=RHSA-2026:87079

   AlmaLinux's own PHP2Shell announcement used a broader form that refreshes the repository metadata first and then upgrades every PHP package:

   sudo dnf clean metadata && sudo dnf upgrade 'php*'

4. 4

   Confirm the fix is installed

   rpm -q php-fpm
   rpm -q --changelog php-fpm | grep -E 'CVE-2026-10961(8|9)'
   dnf updateinfo list --cve CVE-2026-109619 --installed

   The RHEL 9 changelog entry for PHP 8.0.30-8.1, for example, lists "Avoid state corruption via bailout" against both CVE IDs. Rocky Linux's guidance puts it plainly: if the changelog search prints nothing, the installed package does not have the fix. On RHEL 10 with PHP 8.4, query php8.4-fpm instead.

5. 5

   Restart PHP-FPM, not reload it

   sudo systemctl restart php-fpm
   sudo systemctl restart httpd      # only if Apache loads PHP as mod_php
   sudo dnf needs-restarting         # processes still using replaced files

   PHP-FPM has been the default way to run PHP since RHEL 8, and Red Hat's bulletin is explicit that a reload will not do, because existing workers can hold on to state from earlier requests. dnf needs-restarting lists processes rather than services, so read its output as a to-do list. More on worker restarts in the PHP-FPM guide.

Retired streams and branch changes

When your PHP stream gets no fix

Servers still on php:7.2, 7.3 or 8.0 on RHEL 8, or php:8.1 on RHEL 9, have no Red Hat erratum to install. AlmaLinux patched those streams anyway on 23 October 2026 (ALSA-2026:A011 to A014), but warns that it cannot promise the same next time. The durable fix is a supported stream.

RHEL 8 and 9: switch stream

# RHEL 8 or 9: move to a newer, supported stream
sudo dnf module switch-to php:8.3

# Return the php module to its initial state if a switch gets tangled
sudo dnf module reset php

switch-to replaces every package from the old stream with the new stream's versions, and Red Hat's own example uses it to move RHEL 9 from the plain PHP 8.0 package to a stream. Red Hat asks you to back up your data and follow the component's migration notes first. A reset clears the enabled stream without removing installed packages. On RHEL 8 the newest stream is php:8.2.

RHEL 10: swap packages

dnf list --installed 'php*'
sudo dnf remove 'php*'
sudo dnf install php8.4-common php8.4-cli php8.4-fpm

Red Hat's RHEL 10 guide moves to PHP 8.4 by removing the existing PHP packages and installing the php8.4 ones with the extensions you need, so note the list from the first command before removing anything. The guide also warns that dnf's --allowerasing option can take PHP extensions with it unexpectedly.

A branch change is a project, not a patch. If it cannot happen before the server is exposed again, decide whether the site should stay online, and check the PHP end of life dates for the branch you are moving to.

Troubleshooting

When dnf will not give you a fixed PHP

systemctl list-units 'php*'
journalctl -u php-fpm -e
sudo php-fpm -t

Debian and Ubuntu servers use apt and different version rules: updating PHP on Debian and updating PHP on Ubuntu. The Linux overview explains backported versions, and the main update guide covers everything else.