PHP 5.4 Security Patches for CentOS 7
Everpatch PHP keeps the PHP 5.4 that CentOS 7 shipped by default security-patched — a drop-in upgrade for the stock php-5.4.16 packages.
Signed RPM rebuilds of PHP 5.4.45 with current security fixes hand-ported to the 5.4 codebase. Same package names, same extension ABI and the same /etc/php.d layout as stock CentOS 7, so yum upgrade replaces them in place.
The gap
PHP 5.4 was the default PHP of CentOS 7, and many servers still run the stock php-5.4.16 packages. Upstream PHP 5.4 ended in 2015, CentOS 7 went end of life in June 2024, and Remi's last 5.4 build is from 2022, so every PHP security release since then left 5.4 on CentOS 7 exposed.
Everpatch PHP 5.4 ports current security fixes to the 5.4 engine, audited against upstream and against this project's 5.6 ports. Extensions built for stock CentOS 7 PHP and the ionCube 5.4 loader keep loading, because the PHP API and Zend extension ABI are unchanged.
Install
Upgrading stock CentOS 7 PHP 5.4 in place (base-name php-*)
yum -y install https://extras.getpagespeed.com/release-latest.rpm yum --enablerepo=getpagespeed-extras-php54 upgrade php 'php-*' systemctl restart php-fpm # or: systemctl restart httpd php -v
Side by side (software collection, php54-php-*)
yum -y install https://extras.getpagespeed.com/release-latest.rpm yum install php54-php-cli php54-php-fpm systemctl restart php54-php-fpm scl enable php54 -- php -v
Enable the channel per transaction as shown: it carries base-name php, so leaving it on would offer this version to an unscoped yum update. On a fresh host, swap upgrade 'php-*' for install php-cli php-fpm plus the extensions you need.
Hosts on Remi's remi-php54 or its php54-php-* collection upgrade in place the same way; the collection lives in the always-enabled main repository.
PHP 5.4 has no Oracle oci8 build in this channel, matching stock CentOS 7.
Free for personal use. Running it for a business?
Patching EOL PHP is ongoing work: every new PHP CVE has to be ported to branches upstream abandoned years ago, then built and tested on EL7. Commercial production use requires GetPageSpeed Ultra or GetPageSpeed Fleet: either one funds that work and keeps your production servers covered for the next one, together with the full GetPageSpeed repository. Ultra covers up to 10 servers running your own services; Fleet is the plan for servers that host client websites, or for more than 10 servers. 250+ employees or $10M+ revenue, or need a contractual SLA and invoice/PO? That is Enterprise.
Ultra, $500/year Fleet, from $800/year Contact us about Enterprise
Security fixes in this channel
Built from php-5.4.45-19.remi.src.rpm.
The channel's security notes track
67 CVE fixes
and 10 further GitHub security advisories
that never reached the last vendor build for Enterprise Linux 7.
Fixes are ports of the upstream php-src and Remi security patches, audited hunk by hunk; the provenance of every patch is documented per release. The background story of patching EOL PHP on CentOS 7 is covered in our PHP2Shell write-up.
Frequently asked questions
Does it work with the stock CentOS 7 PHP packages?
Yes, that is what it is built for. It ships the same package names as stock CentOS 7 PHP (php, php-cli, php-common, php-mysqlnd, php-gd, ...) with the same extension ABI and configuration paths. Enable the getpagespeed-extras-php54 channel and yum upgrade php 'php-*' replaces php-5.4.16 with the patched 5.4.45 build; your php.ini and php.d edits are kept.
Will my extensions and ionCube keep working?
Extensions built for stock CentOS 7 PHP 5.4 load unchanged, and so does the ionCube Loader for PHP 5.4: every PHP 5.4 release shares one extension ABI. Moving from 5.4.16 to 5.4.45 brings only upstream bug and security fixes within the 5.4 branch, no language changes.
Is PHP 5.4 still safe to run on CentOS 7?
Safer with this channel than without it: the publicly known PHP vulnerabilities that apply to 5.4 are being patched here, years after upstream stopped. PHP 5.4 remains an end-of-life runtime — plan your upgrade on your own schedule. Everpatch exists so a CVE disclosure does not set that schedule for you.
What if I would rather move to a current PHP?
The GetPageSpeed PHP 8.4 stack runs current, upstream-supported PHP on CentOS 7. For a 5.4-era codebase that is usually a porting project — until it happens, this channel keeps the known holes closed.
Do I need a subscription?
Not for personal, development or evaluation use: the PHP packages install from the public GetPageSpeed repository with no signup. Commercial production use requires a subscription under the repository terms: GetPageSpeed Ultra ($500/year) for up to 10 servers running your own services, or GetPageSpeed Fleet (from $800/year) for servers that host client websites or fleets larger than 10. Either one funds these backports and keeps your servers covered for the next EOL PHP CVE. Organizations with 250+ employees or $10M+ revenue, or anyone needing a contractual SLA and invoice/PO procurement, should contact us about Enterprise.