PHP 8.2 Security Updates for CentOS 7
PHP 8.2 is still supported upstream, but Remi's CentOS 7 builds froze at 8.2.20. Everpatch brings EL7 to the current 8.2 release.
Signed RPM rebuilds of Remi's current 8.2 packaging for EL7. Package names stay the same; yum upgrade replaces them in place.
The gap
PHP 8.2 still receives upstream security releases, but CentOS 7 does not: Remi stopped building for EL7 in June 2024, at 8.2.20. Every 8.2 security release since, PHP2Shell included, reached EL8 and newer only.
Everpatch PHP 8.2 rebuilds Remi's current 8.2 source for EL7, so an EL7 host runs the same upstream-fixed 8.2 release as everyone else instead of a two-year-old snapshot.
Install
Replacing system PHP (Remi remi-php82 style, base-name php-*)
yum -y install https://extras.getpagespeed.com/release-latest.rpm yum --enablerepo=getpagespeed-extras-php82 upgrade 'php-*' systemctl restart php-fpm
Side by side (software collection, php82-php-*)
yum -y install https://extras.getpagespeed.com/release-latest.rpm yum install php82-php-cli php82-php-fpm systemctl restart php82-php-fpm scl enable php82 -- php -v
On a fresh host, swap upgrade 'php-*' for install php-cli php-fpm plus the extensions you need. Enable the channel per transaction as shown: it carries base-name php, so leaving it on would offer that version to an unscoped yum update.
The php82-php-* collection lives in the always-enabled main repository, so no channel is needed; on a host with Remi's collection, yum upgrade 'php82-php*' swaps it in place.
Package names match Remi's, so upgrades are in place and yum downgrade takes you back. PECL extensions and ionCube keep working. Running Apache mod_php? Restart httpd instead. Afterwards php -v prints Built by GetPageSpeed LLC.
Every channel is tested serving real pages through both mod_php and PHP-FPM: fresh installs, upgrades from Remi with PECL and ionCube loaded, and the collection builds.
Free for personal use. Running it for a business?
Patching EOL PHP is ongoing work: every new PHP CVE has to be ported to branches upstream abandoned years ago, then built and tested on EL7. Commercial production use requires GetPageSpeed Ultra or GetPageSpeed Fleet: either one funds that work and keeps your production servers covered for the next one, together with the full GetPageSpeed repository. Ultra covers up to 10 servers running your own services; Fleet is the plan for servers that host client websites, or for more than 10 servers. 250+ employees or $10M+ revenue, or need a contractual SLA and invoice/PO? That is Enterprise.
Ultra, $500/year Fleet, from $800/year Contact us about Enterprise
Security fixes in this channel
Built from php82-php-8.2.35-1.remi.src.rpm.
The channel's security notes track
2 CVE fixes
that never reached the last vendor build for Enterprise Linux 7.
| Fixed in Everpatch PHP 8.2 |
|---|
| CVE-2026-109618, CVE-2026-109619 |
Fixes are ports of the upstream php-src and Remi security patches, audited hunk by hunk; the provenance of every patch is documented per release. The background story of patching EOL PHP on CentOS 7 is covered in our PHP2Shell write-up.
Frequently asked questions
PHP 8.2 is still supported. Why does CentOS 7 need this?
Because supported upstream does not mean packaged for EL7. php.net publishes source; on CentOS 7 the binaries came from Remi, and those stopped at 8.2.20. Without a rebuild, an EL7 host stays on 8.2.20 no matter how many 8.2 security releases ship.
Will this replace my existing PHP packages?
Yes, in place. The channel ships the same package names as Remi's PHP 8.2 (base-name php-* in the getpagespeed-extras-php82 channel, SCL php82-php-* in the main repo), with newer versions, so a plain yum upgrade swaps them and yum downgrade reverts.
What happens when PHP 8.2 reaches end of life?
Upstream security support for 8.2 ends on December 31, 2026. Like the older Everpatch channels, this one is built to keep going past that date, porting fixes from the maintained branches. Moving to the PHP 8.4 stack is usually a mild upgrade from 8.2.
Is oci8 (Oracle) available?
Yes, in both shapes: php-oci8 and php82-php-oci8, linked against Oracle Instant Client 21 exactly like Remi's EL7 builds, so an existing Remi oci8 install upgrades cleanly. Install oracle-instantclient-basic 21.x from Oracle first: the GetPageSpeed repository does not redistribute Oracle's libraries.
Do I need a subscription?
Not for personal, development or evaluation use: the PHP packages install from the public GetPageSpeed repository with no signup. Commercial production use requires a subscription under the repository terms: GetPageSpeed Ultra ($500/year) for up to 10 servers running your own services, or GetPageSpeed Fleet (from $800/year) for servers that host client websites or fleets larger than 10. Either one funds these backports and keeps your servers covered for the next EOL PHP CVE. Organizations with 250+ employees or $10M+ revenue, or anyone needing a contractual SLA and invoice/PO procurement, should contact us about Enterprise.