PHP's July 30 security release fixes three CVEs, including a SQL injection in PostgreSQL extensions and a stack overflow in Phar archives. Remi Collet published corresponding RPM packages for Fedora ≥42 and Enterprise Linux ≥8 on July 31, covering PHP 8.5.9, 8.4.24, 8.3.33, and 8.2.33. The updates are available via remi-modular repository or as parallel Software Collections installations. PHP 8.1 has reached end-of-life, so users should upgrade to at least 8.2.33 immediately.

PHP Security Patches Land in Remi's RPMs for Fedora and Enterprise Linux

PHP's July 30 security release now has corresponding packages available in Remi Collet's RPM repository. You can get patched PHP 8.5.9, 8.4.24, 8.3.33, and 8.2.33 for Fedora ≥42 and Enterprise Linux ≥8 starting today.

The updates fix three CVEs that affect all currently supported PHP branches. Remi published the RPMs on July 31, just one day after the upstream security team dropped their patches.

The Three CVEs

CVE-2026-17543 is a SQL injection vulnerability in the PostgreSQL extension. The bug comes from how pg_insert(), pg_update(), pg_select(), and pg_delete() handle escaping when wrapping parameters in escape string constants. Under standard_conforming_strings = on — which is the default on modern PostgreSQL — PQescapeStringConn() doesn't escape backslashes. An attacker can break out of the escaped string and inject SQL. ExPatch-LLC discovered the issue, and PHP core developer Ilia Allura wrote the fix.

CVE-2026-17544 is an out-of-bounds write in bccomp(). When you manually set a scale smaller than what BCMath auto-calculates, the code adjusts one variable but forgets to update another. The subsequent copy operation writes past the allocated buffer. BCMath uses stack-allocated arenas for small numbers and heap for large ones, so depending on your input size, either could get corrupted. Recep Asan reported this one. It only affects PHP 8.4 and 8.5 — not backported to 8.3 or 8.2.

CVE-2026-7260 is a stack overflow in Phar when it encounters circular symlinks. phar_get_link_source() follows symbolic links recursively without any depth limit or cycle detection. A crafted tar-based phar archive with circular symlinks causes unbounded recursion, exhausting the C stack and crashing PHP. Calvin Young from eWalker Consulting found it. It's classified as moderate severity because it requires local access and user interaction.

Build Changes

This round of Remi's packages comes with a few notable build changes. The intl extension now uses libicu74 (version 74.2). On Enterprise Linux builds, mbstring uses oniguruma5php v6.9.10 instead of the outdated system library. The oci8 extension has been updated to Oracle Instant Client RPM version 23.26.

Packages are built against RHEL 10.2, RHEL 9.8, and RHEL 8.10 depending on your Enterprise Linux version. Both x86_64 and aarch64 are supported.

Remi's RPMs are available in two places. The remi-modular repository covers Fedora ≥42 and Enterprise Linux ≥8. You can also find parallel installations as Software Collections in remi-safe. If you want to replace your default PHP with 8.5, switch to the module.

bash

# Enterprise Linux (dnf 4)
sudo dnf module switch-to php:remi-8.5/common
# Fedora (dnf 5)
sudo dnf module reset php
sudo dnf module enable php:remi-8.5
sudo dnf update

Or install it as a Software Collection for parallel use.

bash

sudo yum install php85   # or php84, php83, php82

Official Fedora updates are coming soon too. PHP 8.5.9 is already available in Rawhide. Fedora 44 and 43 will get their updates through Bodhi shortly.

PHP 8.1 has reached end of life. Remi no longer ships 8.1 packages, so if you're still on it, you need to upgrade now. Migration guides are available for each major version jump.

Why It Matters

These patches are exactly the kind of thing most PHP developers never see until something goes wrong. The pgSQL SQL injection is the most dangerous of the three — it affects the most common database extension for PostgreSQL users, and the exploit requires almost nothing. If your application passes user input to pg_select() without additional validation, you're vulnerable.

The BCMath bug is interesting from a technical standpoint but affects a smaller audience. BCMath is typically used for financial calculations, and if you're doing that, you probably already have your own validation layers. Still, out-of-bounds writes are never something you want sitting in production code.

The Phar stack overflow requires local access and user interaction, so it's lower priority. But circular symlinks in phar archives isn't exactly a stretch scenario if you're accepting uploads from untrusted sources.

The PHP security team's monthly release cycle keeps ticking. Eight-point-five-nine is the current stable release for the 8.5 line, and it ships with a solid set of fixes. The non-security updates in this release are worth a look too — there's a use-after-free in array_multisort() that triggers when your comparator mutates the array being sorted. If you're doing complex sorting operations with callbacks that modify their inputs, that one could bite you.

Remi's packages are ready to install. The upgrade path is straightforward. If you haven't checked your PHP version in a while, now's a good time to do it.

Head here to get the Remi RPM repository set up.