Status as of October 26, 2026: Reported by Remi Collet; not confirmed in a second primary source as of October 26, 2026.
The short answer
Stated in one source only, so not confirmed as of October 26, 2026: remi-modular (Fedora ≥ 43, Enterprise Linux ≥ 8): 8.5.12, 8.4.27, 8.3.36, 8.2.35; Software collections (remi-safe): 8.5.12, 8.4.27, 8.3.36, 8.2.35. A fixed package only counts once it’s installed and PHP has restarted (source: AlmaLinux). A related flaw, CVE-2026-115560, has no fix in any PHP release as of October 23, 2026 (source: php.net advisory on CVE-2026-115560, October 23, 2026).
Fix status on Remi
| What | Fixed build or status | Advisory | Confirmed? | Sources |
|---|---|---|---|---|
| remi-modular (Fedora ≥ 43, Enterprise Linux ≥ 8) | 8.5.12, 8.4.27, 8.3.36, 8.2.35 | Remi’s release post, Oct 22, 2026 | No: one source (as of October 26, 2026). Can’t tell from version | Remi Collet: PHP version 8.2.35, 8.3.36, 8.4.27 a… |
| Software collections (remi-safe) | 8.5.12, 8.4.27, 8.3.36, 8.2.35 | Remi’s release post | No: one source (as of October 26, 2026). Can’t tell from version | Remi Collet: PHP version 8.2.35, 8.3.36, 8.4.27 a… |
- PHP 8.1 and older: Remi’s post lists no build and says PHP 8.1 has reached end of life.
How to check on Remi (read-only)
Run these on the server. They only read package data and configuration files.
# 1. Enabled PHP module stream (-C reads the local cache, no network)
dnf -C module list --enabled php
# 2. Installed version: 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later on its branch
rpm -q php-common
rpm -qa 'php8[2-5]-php-common' # software collections from remi-safe
# 3. Has PHP restarted since the update?
rpm -q --last php-common
systemctl show php-fpm -p ActiveEnterTimestamp
# 4. CVE-2026-115560: is the setting in the configuration files?
grep -rns 'session.upload_progress.enabled' /etc/php.ini /etc/php.d/ /etc/opt/remi/ 2>/dev/null
Check the PHP that serves your website, not just the command line: they can be different builds (source: AlmaLinux). The five checks that count as proof.
CVE-2026-115560
On October 23, 2026, PHP disclosed a related flaw, CVE-2026-115560, that the October 21 releases don’t fix. Until its next regular bugfix release, PHP recommends turning off session upload progress (session.upload_progress.enabled=0) in the server configuration and restarting PHP. Setting it from application code (ini_set()) or a per-directory .user.ini file doesn’t count (source: php.net advisory on CVE-2026-115560, October 23, 2026).
On Remi: Remi’s release post doesn’t mention CVE-2026-115560 or session upload progress.
Notes for Remi
- Remi’s packages use PHP’s own version numbers. PHP’s fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (source: php.net release archive), but only Remi’s post states these builds, so we don’t treat the version number as proof yet. Check that PHP was restarted (source: AlmaLinux).
Sources (checked October 26, 2026)
- Remi Collet (Remi’s RPM repository): PHP version 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Page date: Oct 22, 2026 14:58. States: RPMs of 8.5.12, 8.4.27, 8.3.36 and 8.2.35 in remi-modular (Fedora ≥ 43, EL ≥ 8) and as SCL in remi-safe; fix CVE-2026-109618 and CVE-2026-109619; PHP 8.1 has reached its end of life.
Upstream facts (fixed releases, CVE-2026-115560, end-of-life dates) are footnoted to /sources. We list a build as confirmed only when two different primary documents state it. Method.
Related
Red Hat Enterprise Linux 9 · AlmaLinux 9 · All platforms · How to prove your server is patched · What to ask your host or developer
Want it checked for you?
- Patch Verification & Compromise Review. Collection is read-only, and we change nothing on your server. You get a plain-English report: where each fix stands, as of a stated time, plus a compromise review from October 17, signed by the Approver of Record. Ask for it
- Check it yourself, free. The read-only steps are on our PHP2Shell page. Our open-source self-check script is publishing soon.