Technical Briefing: Extended PHP Support for CentOS 7 (Remi Drop-in Replacement)
Today’s source is a GetPageSpeed article on in-place PHP security updates for CentOS 7 servers that run Remi PHP packages. Earlier briefings covered the PHP2Shell vulnerabilities and the CentOS 6 builds, so this briefing does not re-explain them. It focuses on the CentOS 7 situation. Commands, versions and caveats are as stated in the article.
The Problem
Remi stopped building for EL7, and nothing signalled it
- Remi is the long-standing standard source of PHP on Enterprise Linux. It stopped building for EL7 when CentOS 7 reached end of life in June 2024.
- Remi remains fully maintained on EL8, EL9 and EL10.
- The freeze was silent:
yum updatekept exiting cleanly.- Monitoring stayed green.
- EL7 builds stopped at PHP 8.2.20 and 8.3.8.
- Older branches also stopped receiving backports.
How to recognise a stale build
- Any release ending in
.el7.remiis a 2024-or-earlier build. - For example,
7.4.33-15.el7.remiis Remi’s last EL7 PHP 7.4 build. It predates every PHP security fix since.
Why it matters now
- PHP2Shell (CVE-2026-109618 and CVE-2026-109619) was disclosed in October 2026.
- php.net told Remi EL7 users that no updates were coming and that they should build from source.
The Implementation: In-Place Drop-in Packages
GetPageSpeed provides packages for PHP 5.4 through 8.4. They come in both package layouts Remi used.
Step 1: Identify which layout you run
rpm -qa 'php*-common' --qf '%{NAME}-%{VERSION}-%{RELEASE}\n'
Step 2a: Base-name packages
This applies to packages like php-common-7.4.33-15.el7.remi from remi-php74.
yum -y install https://extras.getpagespeed.com/release-latest.rpm
yum --enablerepo=getpagespeed-extras-php74 upgrade 'php-*'
systemctl restart php-fpm
Replace php74 with your branch: php54, php56, php70, php71, php72, php73, php80, php81, php82, php83 or php84.
Step 2b: Software collections
This applies to packages like php74-php-common-7.4.33-15.el7.remi from remi-safe. These packages come from the always-enabled main repo, so no channel needs to be enabled.
yum -y install https://extras.getpagespeed.com/release-latest.rpm
yum upgrade 'php74-php*'
systemctl restart php74-php-fpm
Step 3: Verify
Run php -v. The output should show “Built by GetPageSpeed LLC” with the exact release under the copyright line.
Debian/Ubuntu users on Surý-style packages have a separate equivalent path.
What “Drop-in Compatible” Means
| Property | Detail |
|---|---|
| Same package names | Both base-name php-* and phpNN-php-* packages are provided. There is no new install prefix and no per-site switching. |
| Same ABI and SONAMEs | PECL extensions and ionCube Loader load without a rebuild. Validation confirms the loaded module list is identical before and after the upgrade. |
| Same configs and service names | php-fpm stays php-fpm. php74-php-fpm stays php74-php-fpm. scl enable php74 still works. |
| Reversible | yum downgrade returns you to Remi packages. |
| Independently maintained | These are not a Remi copy. Builds start from Remi’s sources for newer EL where those sources exist. Where upstream published nothing, fixes are ported independently. PHP 7.3 and older during PHP2Shell are an example. |
| Broader than headline CVEs | The 2024–2026 security fixes that EL7 never received are carried into every branch. New batches are ported as they appear. Subscribers get CVE advisory emails. |
| Version range | PHP 5.2 and other older versions are available on request. PHP 8.5 on CentOS 7 is covered separately. |
Comparison with Alternatives (as published November 2026)
TuxCare ELS for PHP
– Ships separate alt-php builds under /opt/alt/php[version]. Each site must be migrated via PHP Selector.
– Lists PHP 5.2–8.5.
– Requires a license key first. Pricing is not published.
– Its CentOS 7 OS-level ELS hands PHP off to a separate Runtimes product.
Cybertrust Japan
– Resells TuxCare ELS for PHP. Its own extended support covers base OS PHP only (5.4).
– License key issuance takes about 5 business days.
– Support is limited to 2 technical questions per contract, with replies targeted within 2 weeks.
– OS extended support costs ¥120,000 (about $760) per server per year, with coverage running to June 2028.
Structural difference: The article states that GetPageSpeed is the only one of the three that updates your existing PHP in place. The other two end with every site migrated to a new PHP build tree.
Pricing and Evaluation
- Packages install from the public repo with no signup. You can upgrade a staging server, confirm
php -v, and run your tests. - Free for personal, development and evaluation use.
- Commercial production requires one of these tiers:
| Tier | Price | Scope |
|---|---|---|
| Ultra | $500/year | Up to 10 servers. Includes priority support and the full NGINX builds/modules repo for CentOS 7. |
| Fleet | From $800/year | Client servers, or more than 10 servers. |
| Enterprise | Not stated | Contractual SLAs or purchase-order procurement. |
Caveats
- This is a bridge, not a destination. If an EL9/EL10 migration is only months away, use Remi’s current builds there instead.
- In-place patching is intended for servers where migration keeps slipping. The article gives these examples:
- The app is certified against one PHP version.
- The vendor is gone.
- The fleet is too large to move this year.
Checking Exposure and Related Tools
- Run
rpm -qa 'php*-common'. Paste the output into the free PHP2Shell checker, or use CVEfox for a backport-aware scan. - GetPageSpeed Amplify runs scheduled gixy scans of NGINX configs tied to live runtime metrics. It is drop-in compatible with the deprecated nginx-amplify-agent (EOL January 2026).
Practical Payoff
CentOS 7 servers on Remi PHP can receive the 2024–2026 security fixes they missed, including PHP2Shell, without disruption:
- Package names, service names, configs and extension ABI stay the same.
- Sites do not need to be migrated to a new PHP tree.
yum downgraderemains available as a path back to Remi packages.
Read the full article: Remi PHP Extended Support: Security Updates for CentOS 7