AlmaLinux’s 21 October 2026 post says patched PHP packages were rolling into production repositories for every PHP stream on AlmaLinux 8, 9, and 10. The command they publish is:
sudo dnf clean metadata && sudo dnf upgrade 'php*'
sudo systemctl restart php-fpm
On AlmaLinux 8 with mod_php, they say to restart httpd instead. Confirm mod_php with httpd -M. They also say most mirrors take a few hours, and that you should compare rpm -q php-common, or rpm -q php8.4-common on AlmaLinux 10’s 8.4 packages, with the versions in their post. Do not use php -v as the proof.
The versions they listed include, among others, AlmaLinux 8 php:7.4 at php-7.4.33-8.module_el8.10.0+4321+cf5fd4bb as Red Hat’s update, php:8.2 at a 8.2.33 alma.1 build, AlmaLinux 9 default php-8.0.30-8.el9_8.alma.1, and AlmaLinux 10 default php-8.3.33-1.el10_2.alma.1. Read the post for the full stream list before you type a version from memory. Retired streams 7.2, 7.3, and 8.0 on AlmaLinux 8, and 8.1 on AlmaLinux 9, were patched with a warning that future fixes are not guaranteed.
AlmaLinux said that at the time of writing Red Hat had fixed only the RHEL 8 php:7.4 stream, and that AlmaLinux shipped the other streams ahead of that. Treat the “only 7.4” sentence as dated 21 October 2026 and recheck Red Hat.
Packages from a panel or Remi are outside this dnf upgrade. PHP said Remi’s repository would not have updates on disclosure day. Confirm Remi separately if you use it.