PHP 8.4 AppStream

Security
1

Hi all,

AlmaLinux contains the PHP 8.4 AppStream, which is great. but it doesn’t seem to receive updates. It is still stuck on PHP 8.4.16, but RHEL and RockyLinux have 8.4.21 last I checked. It is a bit tricky to use the PHP 8.4 AppStream when it doesn’t receive updates. The default PHP 8.3 release does get updates from what I can see.

Is there a policy regarding updating AppStreams, and specifically the PHP one?

2

hi

Which version of AlmaLinux are you using?

thanks

3

AlmaLinux 10. I wasn’t aware AlmaLinux 9 had a PHP AppStream.

4

Thank you for your report.

I have confirmed that PHP 8.4.16 is currently available in AlmaLinux 10. This issue has been reported to the AlmaLinux development team for investigation.

I am just a volunteer.

1 Like
5

AppStream (part of repo) was introduced in el8, along with DNF.
It did change how Red Hat supports RHEL content:

  • BaseOS: full lifetime support
  • AppStream: multiple versions with limited support time
  • CRB: no support

In el8 the application streams were practically all separate DNF modules. One could select module “7.4” and install php, or select module “8.0” and install php.
In el9 the number modular streams were reduced a lot.
In el10 there are no DNF modules at all. The PHP 8.3 package has name php
and the PHP 8.4 has name php8.4.

Only el10 offers PHP 8.4 at the moment.

Remi’s repos ⚙️ PHP version 8.4.22 and 8.5.7 - Remi's RPM repository - Blog offer multiple versions of PHP for all major versions of AlmaLinux.

6

Right, I remember now. We couldn’t use the PHP modules in EL9 because there was no EPEL package for php-sodium for those module versions of PHP. The only way to go would have been to indeed go with Remi’s repo, which we didn’t want to do for various reasons…

7

@fkooman

It looks like they’ve handled it.

1 Like
8

It does look like that not one but two rounds of build were made in rapid succession:

php8.4-8.4.16-1.el10.x86_64.rpm    2026-01-22 16:03
php8.4-8.4.21-1.el10.x86_64.rpm    2026-07-14 15:17
php8.4-8.4.21-1.el10_2.x86_64.rpm  2026-07-15 10:14

RHEL errata shows only the latter 8.4.21, and that was released June 2nd.

9

So, this version doesn’t address the new vulnerabilities. I thought it covered the ones disclosed in early July. Another release must be coming soon, then.
CVE-2026-12184
CVE-2026-14355

10

Red Hat does not yet have either of those, not even initial CVE entry.
Therefore, we do not yet know whether php8.4 in RHEL 10 is affected.

1 Like
11

Yeah, but at least it is up to date with upstream (RHEL 10) now…


[cloud-user@rhel10 ~]$ rpm -q --changelog php8.4-cli | more
* Tue May 26 2026 Remi Collet <rcollet@redhat.com> - 8.4.21-2
- rebase to 8.4.21
```
1 Like
12

It’s not registered…
Thank you.