Updated: 22 October 2026 · Applies to: AlmaLinux 9 / Rocky Linux 9
PHP 7.2 and CentOS 7 are both end of life and no longer get security fixes. Use a supported PHP version on a current system instead. If you're specifically chasing the 21 October 2026 PHP security advisory, update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, whichever branch you run: see How to Fix the Critical PHP Security Vulnerabilities.
AlmaLinux 9 / Rocky Linux 9, from AppStream
dnf module list php # available streams dnf module reset php dnf module enable php:8.3 dnf install php php-fpm php-cli php-mysqlnd php-xml php-mbstring php-gd php-intl php-opcache php-pecl-zip systemctl enable --now php-fpm php -v
Another PHP version, from the Remi repository
Remi carries PHP 8.2, 8.3, 8.4 and 8.5 for Enterprise Linux 9, confirmed on AlmaLinux 9 (dnf module list php lists remi-8.5 and even remi-8.6 as available streams). Swap remi-8.4 for the stream you need:
dnf install epel-release https://rpms.remirepo.net/enterprise/remi-release-9.rpm dnf module reset php && dnf module enable php:remi-8.4 dnf install php php-fpm php-cli php-mysqlnd
Confirm the stream is available before enabling it:
dnf module list php
Already running PHP on this server? Update it in place
Check your current version, then update through the same package manager that installed it:
php -v && dnf update -y "php*"
This updates PHP to whatever the latest version your enabled stream (AppStream or Remi) offers, and is a safe no-op if you're already current.
If an old application only runs on PHP 7, update the application; running unsupported PHP on a public server is a security risk.
