PHP 8.4.25 and 8.5.10 for Fedora/RHEL Hit the Streets, No Security Fixes Attached
Remi Collet has RPMs ready for Fedora ≥43 and Enterprise Linux ≥8, with builds available in his remi-modular repository. PHP 8.4.25 and 8.5.10 dropped on August 27, 2026 as routine bug-fix releases, and the lack of security patches this month actually makes the upgrade path cleaner than usual. You can swap out your system PHP without waiting for distro maintainers to catch up. If you're managing a fleet of AlmaLinux, Rocky, or CentOS Stream boxes, the modular switch is ready to go.
You can pull straight from the remi-modular repository on RHEL, AlmaLinux, CentOS Stream, and Rocky Linux 8 and newer. Fedora Rawhide, Fedora 44, and Fedora 45 already have 8.5.10 pushed through Bodhi, while Fedora 43 gets 8.4.25. Keep in mind that the RPMs are built against specific minor releases of each distribution. EL-10 packages were compiled against RHEL 10.2, EL-9 against 9.8, and EL-8 against 8.10. That baseline matching keeps ABI compatibility tight across enterprise kernels.
The intl extension now ships with libicu74, which means better Unicode handling out of the box. EL builds swap the outdated system mbstring library for oniguruma5php, which finally patches a long-standing regex performance bottleneck. Oracle users get a quiet upgrade too, with oci8 moving to Instant Client 23.26 on both x86_64 and aarch64. Installation is as straightforward as it gets.
Just run dnf module switch-to php:remi-8.5/common on Enterprise Linux or dnf module reset php && dnf module enable php:remi-8.5 && dnf update on Fedora. Parallel installs via yum install php85 or yum install php84 still work if you need to keep your default PHP untouched. Remi also hosts the packages in his remi-safe Software Collections repository for environments that prefer out-of-band toolchains.
What actually changed in these builds
The headline fix for 8.5.10 tackles stack overflows when PHP hits deeply nested arrays or DOM documents. Functions like isEqualNode(), normalize(), and compact() finally play safe under extreme recursion. Opcache JIT gets a tune-up as well, since register-held variables were previously vanishing during property hook getters. The team also officially forbids using \C in UTF-8 PCRE patterns, which pretty much ends that particular segfault headache forever.
PHP 8.4.25 picks up most of those fixes but adds a few of its own. The standout is an out-of-bounds write in shm_attach() when opening an existing segment larger than the actual allocation. You'll also get a LibXML 2.15 build fix, a count() stack overflow patch, and a ZipArchive tweak that finally respects default options. Nothing catastrophic, but that's exactly the kind of edge case that bites production servers at 3 a.m.
Remi's configuration wizard will walk you through the exact module commands for your setup. And if you're still on 8.1, the migration path to 8.4 is documented on php.net. Not exactly quick, but definitely worth the trip.
