PHP 7.2 Security Patches for CentOS 7
Everpatch PHP keeps PHP 7.2 security-patched on EL7, long after upstream and Remi's EL7 builds stopped.
Signed RPM rebuilds of the Remi packages with current security fixes ported to the 7.2 codebase. Package names stay the same; yum upgrade replaces them in place.
The gap
PHP 7.2 has been end of life upstream since November 2020, and CentOS 7 went end of life in June 2024. Remi's last EL7 build of 7.2 is 7.2.34-22, while his EL8+ branch kept receiving fixes that never reached CentOS 7.
Everpatch PHP 7.2 rebuilds Remi's maintained EL8+ source for EL7 and adds what that source lacks: the PHP2Shell pair and the October 2026 security batch, ported from the 7.3 work and audited hunk by hunk.
Install
Replacing system PHP (Remi remi-php72 style, base-name php-*)
yum -y install https://extras.getpagespeed.com/release-latest.rpm yum --enablerepo=getpagespeed-extras-php72 upgrade 'php-*' systemctl restart php-fpm
Side by side (software collection, php72-php-*)
yum -y install https://extras.getpagespeed.com/release-latest.rpm yum install php72-php-cli php72-php-fpm systemctl restart php72-php-fpm scl enable php72 -- php -v
On a fresh host, swap upgrade 'php-*' for install php-cli php-fpm plus the extensions you need. Enable the channel per transaction as shown: it carries base-name php, so leaving it on would offer that version to an unscoped yum update.
The php72-php-* collection lives in the always-enabled main repository, so no channel is needed; on a host with Remi's collection, yum upgrade 'php72-php*' swaps it in place.
Package names match Remi's, so upgrades are in place and yum downgrade takes you back. PECL extensions and ionCube keep working. Running Apache mod_php? Restart httpd instead. Afterwards php -v prints Built by GetPageSpeed LLC.
Every channel is tested serving real pages through both mod_php and PHP-FPM: fresh installs, upgrades from Remi with PECL and ionCube loaded, and the collection builds.
Free for personal use. Running it for a business?
Patching EOL PHP is ongoing work: every new PHP CVE has to be ported to branches upstream abandoned years ago, then built and tested on EL7. Commercial production use requires GetPageSpeed Ultra or GetPageSpeed Fleet: either one funds that work and keeps your production servers covered for the next one, together with the full GetPageSpeed repository. Ultra covers up to 10 servers running your own services; Fleet is the plan for servers that host client websites, or for more than 10 servers. 250+ employees or $10M+ revenue, or need a contractual SLA and invoice/PO? That is Enterprise.
Ultra, $500/year Fleet, from $800/year Contact us about Enterprise
Security fixes in this channel
Built from php72-php-7.2.34-29.remi.src.rpm.
The channel's security notes track
19 CVE fixes
and 2 further GitHub security advisories
that never reached the last vendor build for Enterprise Linux 7.
Fixes are ports of the upstream php-src and Remi security patches, audited hunk by hunk; the provenance of every patch is documented per release. The background story of patching EOL PHP on CentOS 7 is covered in our PHP2Shell write-up.
Frequently asked questions
Is PHP 7.2 still safe to run on CentOS 7?
With this channel, the publicly known PHP CVEs that apply to 7.2 are patched. PHP 7.2 remains an end-of-life runtime: plan your upgrade on your own schedule. Everpatch exists so a CVE disclosure does not set that schedule for you.
Will this replace my existing PHP packages?
Yes, in place. The channel ships the same package names as Remi's PHP 7.2 (base-name php-* in the getpagespeed-extras-php72 channel, SCL php72-php-* in the main repo), with higher release numbers, so a plain yum upgrade swaps them and yum downgrade reverts.
What if I would rather move to a current PHP?
The GetPageSpeed PHP 8.4 stack runs current, upstream-supported PHP on CentOS 7, and its software collection installs side by side, so you can move one site at a time. A smaller first step is PHP 7.4.
Is oci8 (Oracle) available?
Yes, in both shapes: php-oci8 and php72-php-oci8, linked against Oracle Instant Client 21 exactly like Remi's EL7 builds, so an existing Remi oci8 install upgrades cleanly. Install oracle-instantclient-basic 21.x from Oracle first: the GetPageSpeed repository does not redistribute Oracle's libraries.
Do I need a subscription?
Not for personal, development or evaluation use: the PHP packages install from the public GetPageSpeed repository with no signup. Commercial production use requires a subscription under the repository terms: GetPageSpeed Ultra ($500/year) for up to 10 servers running your own services, or GetPageSpeed Fleet (from $800/year) for servers that host client websites or fleets larger than 10. Either one funds these backports and keeps your servers covered for the next EOL PHP CVE. Organizations with 250+ employees or $10M+ revenue, or anyone needing a contractual SLA and invoice/PO procurement, should contact us about Enterprise.