CentOS Linux 8 ended in 2021 and CentOS Linux 7 ended in 2024. They are not going to receive this fix through the old CentOS mirrors. CentOS Stream is a different product. If you run Stream, follow Stream’s own advisories. This review did not record a Stream package version.
Hosts that still say CentOS in /etc/os-release are often panels, appliances, or forgotten VMs. The PHP on them may come from Remi, a panel, or a copy in /usr/local. rpm -q php will tell you if the RPM database even owns the binary the web server uses. If the binary is outside RPM, no CentOS errata can fix it.
The remediation plan is a migration onto a supported rebuild or RHEL, or a vendor backport you can name, plus a test of the application. PHP 5.6 and 7.x consulting applies here more often than a same-day dnf upgrade. Isolation is the interim control when the data is exposed and the package does not exist.
Do not paste AlmaLinux module versions into a CentOS 7 box. The dependencies will not match, and a half-upgraded RPM database is a worse outage than a planned window.