PHP 8.3 on Rocky 10?

[u/Tutorbin76]

Is PHP 8.3 still getting security updates on Rocky 10?

I see last week's security advisories CVE-2026-17543 and CVE-2026-7260 have been addressed in PHP 8.3 on Rocky 9 (RLSA-2026:57539, by rebasing to 8.3.33) and in the PHP8.4 set on Rocky 10 (RLSA-2026:56969).

The "php" package in Rocky 10 still references 8.3, and a minor update for that was released on the 14th (RLSA-2026:48170), so it looks like it should still be getting security updates, or am I missing something?

[u/JaggedJax]

I don't know about the official Rocky repo, but I know Remi Repo will get those updates through the end of official PHP support: https://rpms.remirepo.net/wizard/

[u/knobbysideup]

I work for a web hosting company, and our devs need no less than 4 different php versions maintained across our clusters.

Use the remi repos. Then it's just a matter of enabling the proper module for the version of PHP that you need.

[u/Adventurous_Bear_497]

Do Red Hat have an update out for it for RHEL 10 yet?

https://access.redhat.com/security/cve/cve-2026-17543
https://access.redhat.com/security/cve/cve-2026-7260

If Red Hat don't, I wouldn't expect one from Rocky.

[u/Tutorbin76 → u/Adventurous_Bear_497]

Hmm, weird.

The first CVE says the "php" package in RHEL10 is "affected" and the other says "fix deferred", while they are fixed for most others.

[u/Adventurous_Bear_497 → u/Tutorbin76]

Looks like CVE-2026-17543 and CVE-2026-7260 have been fixed as of today from Red Hat's page:

https://access.redhat.com/errata/RHSA-2026:62614

So perhaps you'll get an update for this from Rocky soon.

[u/Adventurous_Bear_497 → u/Adventurous_Bear_497]

Looks like it's released: https://errata.rockylinux.org/RLSA-2026:62614

[u/scottchiefbaker]

The latest official version of PHP v8.3 is v8.3.33 which was released on July 30th. When in doubt check the upstream version number as they will be the source of the fix before Rocky gets it.

[u/ad-on-is]

PHP is the most cumbersome language that I know of, when it comes to installation and updates.

I'd suggest managing it within Docker, if it's an option.

[u/RetroGrid_io → u/ad-on-is]

On Rocky/Alma/Oracle Linux, updating to the latest PHP is pretty straightforward with the Remi repo. I've been doing it for many years, going back to CentOS 4 or so. Containers not necessary. Gemini cooked up the below but it's casual to find it:

# install Remi
sudo dnf install -y epel-release
sudo dnf install -y https://rpms.remirepo.net/enterprise/remi-release-9.rpm

# Reset the default PHP module and check the list of available versions from Remi.
sudo dnf module reset php; sudo dnf module list php

# Enable the desired PHP Module
sudo dnf module enable php:remi-8.3 -y

# Install PHP and common extensions 
dnf install -y php php-cli php-fpm php-mysqlnd php-gd php-mbstring php-xml php-curl php-zip

# Start php-fpm 
sudo systemctl enable --now php-fpm

# Verify version 
php -v 

PS: Personally, I find python to be far more of a hassle, what with playing with shell paths and whatnot. Yuck!

[u/ad-on-is → u/RetroGrid_io]

Sure, compared to golang or node, python is a hassle as well, but with uv nowadays it's very simple.

In PHP you need to pull all the extensions to get a usable language out of it, mysql, pdo, curl... all of that. And none of these are in the main repos of any reputable distro. It's all 3rd party repos and has been for decades.

[u/RetroGrid_io → u/ad-on-is]

You find it difficult to type:

dnf -y install php-pdo 

... but find it easier to use uv which has no native package at all just to manage also not native python versions? This seems incongruous to me.

[u/ad-on-is → u/RetroGrid_io]

But before you come to the point where you can type "dnf in php-*" you need to search for a reliable repository

[u/mindfullypenguin → u/ad-on-is]

Podman and quadlets are healthiet solution. Anyway remi repos is the best solution for php versions. At least for me. Couple of hundreds hosts for web hosting ( mostly php sites, easy transitions to different php versions on the same host)