PHP 8.3 Security Updates for CentOS 7
PHP 8.3 is still supported upstream, but Remi's CentOS 7 builds froze at 8.3.8. Everpatch brings EL7 to the current 8.3 release.
Signed RPM rebuilds of Remi's current 8.3 packaging for EL7. Package names stay the same; yum upgrade replaces them in place.
The gap
PHP 8.3 is in its security-support phase upstream, but CentOS 7 stopped receiving it in June 2024: Remi's last EL7 build is 8.3.8. Every 8.3 security release since, PHP2Shell included, reached EL8 and newer only.
Everpatch PHP 8.3 rebuilds Remi's current 8.3 source for EL7, so an EL7 host runs the same upstream-fixed 8.3 release as everyone else.
Install
Replacing system PHP (Remi remi-php83 style, base-name php-*)
yum -y install https://extras.getpagespeed.com/release-latest.rpm yum --enablerepo=getpagespeed-extras-php83 upgrade 'php-*' systemctl restart php-fpm
Side by side (software collection, php83-php-*)
yum -y install https://extras.getpagespeed.com/release-latest.rpm yum install php83-php-cli php83-php-fpm systemctl restart php83-php-fpm scl enable php83 -- php -v
On a fresh host, swap upgrade 'php-*' for install php-cli php-fpm plus the extensions you need. Enable the channel per transaction as shown: it carries base-name php, so leaving it on would offer that version to an unscoped yum update.
The php83-php-* collection lives in the always-enabled main repository, so no channel is needed; on a host with Remi's collection, yum upgrade 'php83-php*' swaps it in place.
Package names match Remi's, so upgrades are in place and yum downgrade takes you back. PECL extensions and ionCube keep working. Running Apache mod_php? Restart httpd instead. Afterwards php -v prints Built by GetPageSpeed LLC.
Every channel is tested serving real pages through both mod_php and PHP-FPM: fresh installs, upgrades from Remi with PECL and ionCube loaded, and the collection builds.
Free for personal use. Running it for a business?
Patching EOL PHP is ongoing work: every new PHP CVE has to be ported to branches upstream abandoned years ago, then built and tested on EL7. Commercial production use requires GetPageSpeed Ultra or GetPageSpeed Fleet: either one funds that work and keeps your production servers covered for the next one, together with the full GetPageSpeed repository. Ultra covers up to 10 servers running your own services; Fleet is the plan for servers that host client websites, or for more than 10 servers. 250+ employees or $10M+ revenue, or need a contractual SLA and invoice/PO? That is Enterprise.
Ultra, $500/year Fleet, from $800/year Contact us about Enterprise
Security fixes in this channel
Built from php83-php-8.3.36-1.remi.src.rpm.
The channel's security notes track
2 CVE fixes
that never reached the last vendor build for Enterprise Linux 7.
| Fixed in Everpatch PHP 8.3 |
|---|
| CVE-2026-109618, CVE-2026-109619 |
Fixes are ports of the upstream php-src and Remi security patches, audited hunk by hunk; the provenance of every patch is documented per release. The background story of patching EOL PHP on CentOS 7 is covered in our PHP2Shell write-up.
Frequently asked questions
PHP 8.3 is still supported. Why does CentOS 7 need this?
Because supported upstream does not mean packaged for EL7. On CentOS 7 the binaries came from Remi, and those stopped at 8.3.8. Without a rebuild, an EL7 host stays on 8.3.8 no matter how many 8.3 security releases ship.
Will this replace my existing PHP packages?
Yes, in place. The channel ships the same package names as Remi's PHP 8.3 (base-name php-* in the getpagespeed-extras-php83 channel, SCL php83-php-* in the main repo), with newer versions, so a plain yum upgrade swaps them and yum downgrade reverts.
Should I go to 8.4 instead?
If your code runs on it, yes: the PHP 8.4 stack is the newest line, supported upstream the longest. Stay on this channel while you test.
Is oci8 (Oracle) available?
Yes, in both shapes: php-oci8 and php83-php-oci8, linked against Oracle Instant Client 21 exactly like Remi's EL7 builds, so an existing Remi oci8 install upgrades cleanly. Install oracle-instantclient-basic 21.x from Oracle first: the GetPageSpeed repository does not redistribute Oracle's libraries.
Do I need a subscription?
Not for personal, development or evaluation use: the PHP packages install from the public GetPageSpeed repository with no signup. Commercial production use requires a subscription under the repository terms: GetPageSpeed Ultra ($500/year) for up to 10 servers running your own services, or GetPageSpeed Fleet (from $800/year) for servers that host client websites or fleets larger than 10. Either one funds these backports and keeps your servers covered for the next EOL PHP CVE. Organizations with 250+ employees or $10M+ revenue, or anyone needing a contractual SLA and invoice/PO procurement, should contact us about Enterprise.