How to Update PHP on AlmaLinux, Rocky, and RHEL After PHP2Shell

Summary

On AlmaLinux, Rocky Linux, and RHEL, the fix is installed with dnf update php*, followed by a php-fpm restart. If PHP is installed from the Remi repository, update its module. Verify the result in the package changelog, not in the output of php -v.

Step 1. Determine where PHP was installed from

rpm -q php-fpm php-cli
dnf module list php --enabled

If the package name contains remi, PHP came from the Remi repository. If the module is enabled as php:8.3, you are using the distribution's own module stream.

Step 2. Update

For distribution packages:

sudo dnf clean all
sudo dnf update php php-fpm php-cli php-common

For Remi, it is easier to update all PHP packages at once:

sudo dnf update 'php*'

If you are switching to a new module stream (for example, from 8.2 to 8.3), reset the current one first:

sudo dnf module reset php
sudo dnf module enable php:8.3
sudo dnf distro-sync 'php*'

Step 3. Restart

sudo systemctl restart php-fpm
systemctl status php-fpm --no-pager

Without a restart, the worker processes keep executing the old code and the server stays vulnerable.

Step 4. Verify

rpm -q --changelog php-cli | grep -m2 -E 'CVE-2026-109618|CVE-2026-109619'
rpm -q php-fpm

If lines containing the CVE numbers are found, the fix is in place.

SELinux note

Updating packages does not change the SELinux policy. However, if you edited the PHP-FPM socket paths manually, check that the service started without denials:

sudo ausearch -m avc -ts recent | tail -20

If PHP runs in a container or under a control panel

Updating packages on the host does not affect PHP inside containers: you must rebuild the image. Control panels update their own PHP builds with their own tools. These cases are covered in separate articles.

Frequently asked questions

Why does dnf say there are no updates available?

The metadata cache is probably stale. Run sudo dnf clean all and try again. If the Remi repository is disabled, packages from it will not be updated.

Do I need to restart nginx after updating PHP?

No. nginx talks to PHP-FPM through a socket and does not need a restart. The exception is mod_php under Apache, where you restart httpd.

Can I update PHP on AlmaLinux without downtime?

A php-fpm restart takes a fraction of a second. On busy sites, take the server out of the load balancer or use systemctl reload php-fpm if your build supports it.