Remi Ships Patched PHP 8.5.11, 8.4.26, 8.3.35, and 8.2.34 for RHEL and Fedora
Ten CVEs are fixed in the September 25 rebuild of the remi RPM repository. Remi Collet marked the update as strongly recommended, which is a phrase admins take seriously when they see it. The target is everyone running RHEL-family systems who pull PHP from a third-party repo instead of compiling from source.
The rebuild covers four active branches. Grab PHP 8.5.11, 8.4.26, 8.3.35, or 8.2.34 from the remi-modular repository, and they'll all share the same version date: 24 September 2026. That's the upstream PHP Group security cycle, repackaged for RHEL 8, RHEL 9, RHEL 10, and Fedora 43 and up.
For admins of RHEL-family machines, the upstream PHP Group announcements only tell half the story. Most enterprise deployments don't compile PHP from source. They pull it from distro module streams or trusted third-party repos, which is exactly the gap that Remi's repo fills. He rebuilds and backports these releases straight into the dnf/yum system, keeping everything stitched to the distro's native C libraries. As of right now, his packages are the de facto way many operators get current PHP without waiting for Red Hat's much slower update cadence.
Remi has kept this repo going for well over a decade, and he contributes to PHP itself, maintaining PECL extensions and packages in Fedora. It's become such a staple that some vendor repos quietly fall into line behind it. Not a stretch to see a package version land in a distro repository weeks after it showed up in remi first.
The ten CVEs behind the rebuild
The update addresses ten security issues, and the ones that matter most live in the normal request path. That means they're reachable during everyday traffic, not just in some obscure corner of the codebase.
Start with the FPM hole. CVE-2026-91768 is an IPv6 ACL bypass in listen.allowed_clients. A partial address comparison lets an IPv6 client slip past the access-control list, which for deployments relying on FPM network isolation is a genuine problem.
The TLS side is worse. CVE-2026-91769 makes OpenSSL fall back to the Common Name on a SAN mismatch. Modern certificates rarely populate CN anymore, so this accepts a valid certificate for a different host. It's a textbook man-in-the-middle flaw. CVE-2026-91767 is a separate heap buffer overflow triggered by a crafted wildcard certificate.
The rest of the cycle rounds out the usual nasty mix. There's Phar archive injection (CVE-2026-6103), a SOAP stack-exhaustion recursion (CVE-2026-91765), and a cross-origin credential leak during redirects (CVE-2026-91766) that dumps authorization headers at the wrong origin. Then a mysqlnd packet overread (CVE-2025-1218), a SOAP integer-to-buffer overflow (CVE-2025-14181), and two out-of-bounds reads in the standard stream layer (CVE-2026-93682, CVE-2026-92842). A twelfth issue, CVE-2026-17545, fixes Windows reserved device names but only affects Windows builds. Linux admins can skip it.
Which Remi package should you install?
The obvious target is PHP 8.5.11. It's the first steady-state maintenance release for 8.5, which landed on 20 November 2025 under the banner "Smarter, Faster, Built for Tomorrow." Beyond the security fixes, 8.5 ships some genuinely useful features: a built-in URI extension for parsing per RFC 3986, a pipe operator for chaining callables, clone-with for updating properties mid-clone, and the #[\NoDiscard] attribute to warn when you ignore a return value.
Newer lines absorb more work. 8.5.11 fixes a pile of memory-safety bugs across Core, DOM, Opcache, Intl, and a dozen other extensions, including a hash_pbkdf2() overflow that carries no separate CVE. 8.4.26 mirrors nearly all of that and adds a fix for a severe imagebmp() slowness regression that'll make some of your image generation feel snappy again. 8.3.35 and 8.2.34 are leaner and security-only now, though 8.3 keeps the FILTER_SANITIZE_ENCODED fix before it fully transitions. PHP 8.1 is gone, having reached end of life, which is why it's missing from the batch.
The RPMs are built for x86_64 and aarch64. Remi built the EL-10 packages on RHEL 10.2, EL-9 on RHEL 9.8, and EL-8 on RHEL 8.10. The builds also carry a few library bumps: intl now links libicu74, mbstring uses oniguruma5php instead of the aging system library, and oci8 targets Oracle Instant Client 23.26.
To switch to 8.5 on Enterprise Linux (dnf 4), run something like:
dnf module switch-to php:remi-8.5/common
On Fedora (dnf 5), it's a two-step dance:
dnf module reset php dnf module enable php:remi-8.5 dnf update
You can also install a version in parallel as a Software Collection with yum install php85. Head here to Remi's Configuration Wizard if you want to walk through version and mode interactively.
Keep in mind that Fedora's own updates are already queued. Rawhide ships 8.5.11, and Fedora 43, 44, and 45 are staged in Bodhi.
If you're running internet-facing FPM, upgrade soon. The IPv6 ACL bypass alone is enough to make you care, and so are the cross-origin credential leak and the memory-corruption flaws in commonly used extensions. Verify after the fact with php -v across every SAPI you run — CLI, FPM/FastCGI, and the Apache module all need to show the patched string.
Operators still on PHP 8.1 or earlier are on their own. That branch is end-of-life and unprotected. Migrate to at least 8.2, and honestly 8.4 or 8.5 if you want current features rather than security-only patches. The PHP Group's migration guides are pinned to each version's manual if you need help getting from one branch to the next.
Head here to the official announcement.
