Hi, What is the expectation on availability of updated php packages addressing the two critical vulnerabilities disclosed today? PHP: News Archive - 2026 Which php versions on which Rocky releases will be patched? Thanks

As a rebuild of RHEL, the quick answer is that we’ll update the PHP versions they do and do so when they release their updates. We are looking into what it will take to backport the fixes ourselves into our security repo, but we can’t make any promises there as to which versions we’ll patch or how …

Hi, a faster implementation of the patch via security repo wouldnt be possible ? (Like updates have been provided for kernel patches) ? This vulnerability has a greater attack surface as it is fully remote. Thank you for the information you could provide.

Hey @sysadmin , it may be possible, but we did not have access to the patches before they were released to the public, so we’re starting at the beginning on backporting them. We’re looking into it right now, but, as I said before, we can’t make any promises.

Thank you very much for your work @jdieter !

https://access.redhat.com/errata/RHSA-2026:87072 https://access.redhat.com/errata/RHSA-2026:87080

These should now be in 9. It was the last to sync. The following builds should now be available: Rocky 8: php-7.4.33-8.module+el8.10.0+40393+c071e357 php-8.2.35-1.module+el8.10.0+40394+d21b33fb Rocky 9: php-8.0.30-8.el9_8.1 php-8.2.35-1.module+el9.8.0+40395+2f706e64 php-8.3.36-1.module+el9.8.…

We may need to speed this up so we can apply the PHP security patches. It looks like a critical security issue.

This didn’t work a half hour ago, but it did this time (it probably depends on your mirror): sudo dnf clean all sudo dnf update --refresh php

Critical PHP vulnerabilities

Rocky Linux Help & Support

tkell October 21, 2026, 11:06pm 7

@jdieter Appreciate the information in this thread. Will the backported fixes for php 8.0 be available as well? I’m not seeing them as available on our Rocky 9 hosts yet.

Topic		Replies	Views
Rocky Linux 8.8 an PHP 8.1 Rocky Linux Help & Support	5	7434	September 10, 2023
New kernel and New packages Rocky Linux Help & Support	5	1139	February 11, 2022
Fragnesia - CVE-2026-46300 Rocky Linux Help & Support	32	4890	June 5, 2026
Rocky Linux 9.6 Available Now Announcements rocky-linux-9	14	1353	June 11, 2025
PHP 7.4 errata affected packages Rocky Linux Help & Support	3	556	February 9, 2023

Critical PHP vulnerabilities

Related topics