x86_64 GetPageSpeed extras (php56) repository for CentOS/RHEL 7

Update: php-5.6.40-46.el7

Sat, 24 Oct 2026 10:24:55 +0000

Package: php
Summary: PHP scripting language for creating dynamic web sites

Description:
PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server.

Changes:

php-5.6.40-46.el7.x86_64 [2.6 MiB]	Changelog by Danila Vershinin (2026-10-24): - stage php.d ini files with install -m 644 instead of cp -p: the build-host SOURCES mode (0600) leaked into the RPM, making 10-opcache.ini root-only and silently disabling OPcache for non-root CLI
php-5.6.40-45.el7.x86_64 [2.6 MiB]	Changelog by Danila Vershinin (2026-10-24): - add gps_license license-presence extension, statically compiled into every SAPI (ADR-002): phpinfo attribution section, cron.daily verdict heartbeat, dormant guarded HTML footer tier (hard clamps to footer, fail-open to soft)
php-5.6.40-44.el7.x86_64 [2.6 MiB]	Changelog by Danila Vershinin (2026-10-23): - enable the oci8 / pdo_oci build (new oci8 subpackage), linked against Oracle Instant Client 21.13 exactly like Remi's EL7 build (soname libclntsh.so.21.1; the client is fetched at build time only and never shipped). Unblocks the Remi to GetPageSpeed upgrade on hosts that have Remi's oci8 package installed (its exact-NVR pdo dependency).
php-5.6.40-43.el7.x86_64 [2.6 MiB]	Changelog by Danila Vershinin (2026-10-22): - Port the October 2026 security batch from Remi's php74-php 7.4.33-29..31 (Remi's 5.6 stops at 5.6.40-47); provenance in SECURITY.md: CVE-2026-92842 CVE-2026-91768 CVE-2026-91769 CVE-2026-91767 CVE-2025-1218 (with the CVE-2024-8929 hardening it builds on) CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - CVE-2026-93682 does not affect 5.6 (NUL-terminated Location buffer) - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - php-common requires getpagespeed-extras-release
php-5.6.40-42.el7.x86_64 [2.6 MiB]	Changelog by Danila Vershinin (2026-10-22): - Import security patches from Remi's maintained php56-php 5.6.40-47 (GH-22187 context refreshed for the EL7 base): CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-8932 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619

Update: php-bcmath-5.6.40-46.el7

Sat, 24 Oct 2026 10:24:55 +0000

Package: php-bcmath
Summary: A module for PHP applications for using the bcmath library

Description:
The php-bcmath package contains a dynamic shared object that will add support for using the bcmath library to PHP.

Changes:

php-bcmath-5.6.40-46.el7.x86_64 [71 KiB]	Changelog by Danila Vershinin (2026-10-24): - stage php.d ini files with install -m 644 instead of cp -p: the build-host SOURCES mode (0600) leaked into the RPM, making 10-opcache.ini root-only and silently disabling OPcache for non-root CLI
php-bcmath-5.6.40-45.el7.x86_64 [70 KiB]	Changelog by Danila Vershinin (2026-10-24): - add gps_license license-presence extension, statically compiled into every SAPI (ADR-002): phpinfo attribution section, cron.daily verdict heartbeat, dormant guarded HTML footer tier (hard clamps to footer, fail-open to soft)
php-bcmath-5.6.40-44.el7.x86_64 [70 KiB]	Changelog by Danila Vershinin (2026-10-23): - enable the oci8 / pdo_oci build (new oci8 subpackage), linked against Oracle Instant Client 21.13 exactly like Remi's EL7 build (soname libclntsh.so.21.1; the client is fetched at build time only and never shipped). Unblocks the Remi to GetPageSpeed upgrade on hosts that have Remi's oci8 package installed (its exact-NVR pdo dependency).
php-bcmath-5.6.40-43.el7.x86_64 [70 KiB]	Changelog by Danila Vershinin (2026-10-22): - Port the October 2026 security batch from Remi's php74-php 7.4.33-29..31 (Remi's 5.6 stops at 5.6.40-47); provenance in SECURITY.md: CVE-2026-92842 CVE-2026-91768 CVE-2026-91769 CVE-2026-91767 CVE-2025-1218 (with the CVE-2024-8929 hardening it builds on) CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - CVE-2026-93682 does not affect 5.6 (NUL-terminated Location buffer) - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - php-common requires getpagespeed-extras-release
php-bcmath-5.6.40-42.el7.x86_64 [71 KiB]	Changelog by Danila Vershinin (2026-10-22): - Import security patches from Remi's maintained php56-php 5.6.40-47 (GH-22187 context refreshed for the EL7 base): CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-8932 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619

Update: php-cli-5.6.40-46.el7

Sat, 24 Oct 2026 10:24:55 +0000

Package: php-cli
Summary: Command-line interface for PHP

Description:
The php-cli package contains the command-line interface executing PHP scripts, /usr/bin/php, and the CGI interface.

Changes:

php-cli-5.6.40-46.el7.x86_64 [4.0 MiB]	Changelog by Danila Vershinin (2026-10-24): - stage php.d ini files with install -m 644 instead of cp -p: the build-host SOURCES mode (0600) leaked into the RPM, making 10-opcache.ini root-only and silently disabling OPcache for non-root CLI
php-cli-5.6.40-45.el7.x86_64 [4.0 MiB]	Changelog by Danila Vershinin (2026-10-24): - add gps_license license-presence extension, statically compiled into every SAPI (ADR-002): phpinfo attribution section, cron.daily verdict heartbeat, dormant guarded HTML footer tier (hard clamps to footer, fail-open to soft)
php-cli-5.6.40-44.el7.x86_64 [4.0 MiB]	Changelog by Danila Vershinin (2026-10-23): - enable the oci8 / pdo_oci build (new oci8 subpackage), linked against Oracle Instant Client 21.13 exactly like Remi's EL7 build (soname libclntsh.so.21.1; the client is fetched at build time only and never shipped). Unblocks the Remi to GetPageSpeed upgrade on hosts that have Remi's oci8 package installed (its exact-NVR pdo dependency).
php-cli-5.6.40-43.el7.x86_64 [4.0 MiB]	Changelog by Danila Vershinin (2026-10-22): - Port the October 2026 security batch from Remi's php74-php 7.4.33-29..31 (Remi's 5.6 stops at 5.6.40-47); provenance in SECURITY.md: CVE-2026-92842 CVE-2026-91768 CVE-2026-91769 CVE-2026-91767 CVE-2025-1218 (with the CVE-2024-8929 hardening it builds on) CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - CVE-2026-93682 does not affect 5.6 (NUL-terminated Location buffer) - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - php-common requires getpagespeed-extras-release
php-cli-5.6.40-42.el7.x86_64 [4.0 MiB]	Changelog by Danila Vershinin (2026-10-22): - Import security patches from Remi's maintained php56-php 5.6.40-47 (GH-22187 context refreshed for the EL7 base): CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-8932 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619

Update: php-common-5.6.40-46.el7

Sat, 24 Oct 2026 10:24:55 +0000

Package: php-common
Summary: Common files for PHP

Description:
The php-common package contains files used by both the php package and the php-cli package.

Changes:

php-common-5.6.40-46.el7.x86_64 [1.1 MiB]	Changelog by Danila Vershinin (2026-10-24): - stage php.d ini files with install -m 644 instead of cp -p: the build-host SOURCES mode (0600) leaked into the RPM, making 10-opcache.ini root-only and silently disabling OPcache for non-root CLI
php-common-5.6.40-45.el7.x86_64 [1.1 MiB]	Changelog by Danila Vershinin (2026-10-24): - add gps_license license-presence extension, statically compiled into every SAPI (ADR-002): phpinfo attribution section, cron.daily verdict heartbeat, dormant guarded HTML footer tier (hard clamps to footer, fail-open to soft)
php-common-5.6.40-44.el7.x86_64 [1.1 MiB]	Changelog by Danila Vershinin (2026-10-23): - enable the oci8 / pdo_oci build (new oci8 subpackage), linked against Oracle Instant Client 21.13 exactly like Remi's EL7 build (soname libclntsh.so.21.1; the client is fetched at build time only and never shipped). Unblocks the Remi to GetPageSpeed upgrade on hosts that have Remi's oci8 package installed (its exact-NVR pdo dependency).
php-common-5.6.40-43.el7.x86_64 [1.1 MiB]	Changelog by Danila Vershinin (2026-10-22): - Port the October 2026 security batch from Remi's php74-php 7.4.33-29..31 (Remi's 5.6 stops at 5.6.40-47); provenance in SECURITY.md: CVE-2026-92842 CVE-2026-91768 CVE-2026-91769 CVE-2026-91767 CVE-2025-1218 (with the CVE-2024-8929 hardening it builds on) CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - CVE-2026-93682 does not affect 5.6 (NUL-terminated Location buffer) - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - php-common requires getpagespeed-extras-release
php-common-5.6.40-42.el7.x86_64 [1.1 MiB]	Changelog by Danila Vershinin (2026-10-22): - Import security patches from Remi's maintained php56-php 5.6.40-47 (GH-22187 context refreshed for the EL7 base): CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-8932 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619

Update: php-dba-5.6.40-46.el7

Sat, 24 Oct 2026 10:24:55 +0000

Package: php-dba
Summary: A database abstraction layer module for PHP applications

Description:
The php-dba package contains a dynamic shared object that will add support for using the DBA database abstraction layer to PHP.

Changes:

php-dba-5.6.40-46.el7.x86_64 [76 KiB]	Changelog by Danila Vershinin (2026-10-24): - stage php.d ini files with install -m 644 instead of cp -p: the build-host SOURCES mode (0600) leaked into the RPM, making 10-opcache.ini root-only and silently disabling OPcache for non-root CLI
php-dba-5.6.40-45.el7.x86_64 [76 KiB]	Changelog by Danila Vershinin (2026-10-24): - add gps_license license-presence extension, statically compiled into every SAPI (ADR-002): phpinfo attribution section, cron.daily verdict heartbeat, dormant guarded HTML footer tier (hard clamps to footer, fail-open to soft)
php-dba-5.6.40-44.el7.x86_64 [75 KiB]	Changelog by Danila Vershinin (2026-10-23): - enable the oci8 / pdo_oci build (new oci8 subpackage), linked against Oracle Instant Client 21.13 exactly like Remi's EL7 build (soname libclntsh.so.21.1; the client is fetched at build time only and never shipped). Unblocks the Remi to GetPageSpeed upgrade on hosts that have Remi's oci8 package installed (its exact-NVR pdo dependency).
php-dba-5.6.40-43.el7.x86_64 [75 KiB]	Changelog by Danila Vershinin (2026-10-22): - Port the October 2026 security batch from Remi's php74-php 7.4.33-29..31 (Remi's 5.6 stops at 5.6.40-47); provenance in SECURITY.md: CVE-2026-92842 CVE-2026-91768 CVE-2026-91769 CVE-2026-91767 CVE-2025-1218 (with the CVE-2024-8929 hardening it builds on) CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - CVE-2026-93682 does not affect 5.6 (NUL-terminated Location buffer) - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - php-common requires getpagespeed-extras-release
php-dba-5.6.40-42.el7.x86_64 [76 KiB]	Changelog by Danila Vershinin (2026-10-22): - Import security patches from Remi's maintained php56-php 5.6.40-47 (GH-22187 context refreshed for the EL7 base): CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-8932 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619

Update: php-dbg-5.6.40-46.el7

Sat, 24 Oct 2026 10:24:55 +0000

Package: php-dbg
Summary: The interactive PHP debugger

Description:
The php-dbg package contains the interactive PHP debugger.

Changes:

php-dbg-5.6.40-46.el7.x86_64 [1.4 MiB]	Changelog by Danila Vershinin (2026-10-24): - stage php.d ini files with install -m 644 instead of cp -p: the build-host SOURCES mode (0600) leaked into the RPM, making 10-opcache.ini root-only and silently disabling OPcache for non-root CLI
php-dbg-5.6.40-45.el7.x86_64 [1.4 MiB]	Changelog by Danila Vershinin (2026-10-24): - add gps_license license-presence extension, statically compiled into every SAPI (ADR-002): phpinfo attribution section, cron.daily verdict heartbeat, dormant guarded HTML footer tier (hard clamps to footer, fail-open to soft)
php-dbg-5.6.40-44.el7.x86_64 [1.4 MiB]	Changelog by Danila Vershinin (2026-10-23): - enable the oci8 / pdo_oci build (new oci8 subpackage), linked against Oracle Instant Client 21.13 exactly like Remi's EL7 build (soname libclntsh.so.21.1; the client is fetched at build time only and never shipped). Unblocks the Remi to GetPageSpeed upgrade on hosts that have Remi's oci8 package installed (its exact-NVR pdo dependency).
php-dbg-5.6.40-43.el7.x86_64 [1.4 MiB]	Changelog by Danila Vershinin (2026-10-22): - Port the October 2026 security batch from Remi's php74-php 7.4.33-29..31 (Remi's 5.6 stops at 5.6.40-47); provenance in SECURITY.md: CVE-2026-92842 CVE-2026-91768 CVE-2026-91769 CVE-2026-91767 CVE-2025-1218 (with the CVE-2024-8929 hardening it builds on) CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - CVE-2026-93682 does not affect 5.6 (NUL-terminated Location buffer) - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - php-common requires getpagespeed-extras-release
php-dbg-5.6.40-42.el7.x86_64 [1.4 MiB]	Changelog by Danila Vershinin (2026-10-22): - Import security patches from Remi's maintained php56-php 5.6.40-47 (GH-22187 context refreshed for the EL7 base): CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-8932 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619

Update: php-devel-5.6.40-46.el7

Sat, 24 Oct 2026 10:24:55 +0000

Package: php-devel
Summary: Files needed for building PHP extensions

Description:
The php-devel package contains the files needed for building PHP extensions. If you need to compile your own PHP extensions, you will need to install this package.

Changes:

php-devel-5.6.40-46.el7.x86_64 [972 KiB]	Changelog by Danila Vershinin (2026-10-24): - stage php.d ini files with install -m 644 instead of cp -p: the build-host SOURCES mode (0600) leaked into the RPM, making 10-opcache.ini root-only and silently disabling OPcache for non-root CLI
php-devel-5.6.40-45.el7.x86_64 [972 KiB]	Changelog by Danila Vershinin (2026-10-24): - add gps_license license-presence extension, statically compiled into every SAPI (ADR-002): phpinfo attribution section, cron.daily verdict heartbeat, dormant guarded HTML footer tier (hard clamps to footer, fail-open to soft)
php-devel-5.6.40-44.el7.x86_64 [971 KiB]	Changelog by Danila Vershinin (2026-10-23): - enable the oci8 / pdo_oci build (new oci8 subpackage), linked against Oracle Instant Client 21.13 exactly like Remi's EL7 build (soname libclntsh.so.21.1; the client is fetched at build time only and never shipped). Unblocks the Remi to GetPageSpeed upgrade on hosts that have Remi's oci8 package installed (its exact-NVR pdo dependency).
php-devel-5.6.40-43.el7.x86_64 [971 KiB]	Changelog by Danila Vershinin (2026-10-22): - Port the October 2026 security batch from Remi's php74-php 7.4.33-29..31 (Remi's 5.6 stops at 5.6.40-47); provenance in SECURITY.md: CVE-2026-92842 CVE-2026-91768 CVE-2026-91769 CVE-2026-91767 CVE-2025-1218 (with the CVE-2024-8929 hardening it builds on) CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - CVE-2026-93682 does not affect 5.6 (NUL-terminated Location buffer) - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - php-common requires getpagespeed-extras-release
php-devel-5.6.40-42.el7.x86_64 [971 KiB]	Changelog by Danila Vershinin (2026-10-22): - Import security patches from Remi's maintained php56-php 5.6.40-47 (GH-22187 context refreshed for the EL7 base): CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-8932 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619

Update: php-embedded-5.6.40-46.el7

Sat, 24 Oct 2026 10:24:55 +0000

Package: php-embedded
Summary: PHP library for embedding in applications

Description:
The php-embedded package contains a library which can be embedded into applications to provide PHP scripting language support.

Changes:

php-embedded-5.6.40-46.el7.x86_64 [1.3 MiB]	Changelog by Danila Vershinin (2026-10-24): - stage php.d ini files with install -m 644 instead of cp -p: the build-host SOURCES mode (0600) leaked into the RPM, making 10-opcache.ini root-only and silently disabling OPcache for non-root CLI
php-embedded-5.6.40-45.el7.x86_64 [1.3 MiB]	Changelog by Danila Vershinin (2026-10-24): - add gps_license license-presence extension, statically compiled into every SAPI (ADR-002): phpinfo attribution section, cron.daily verdict heartbeat, dormant guarded HTML footer tier (hard clamps to footer, fail-open to soft)
php-embedded-5.6.40-44.el7.x86_64 [1.3 MiB]	Changelog by Danila Vershinin (2026-10-23): - enable the oci8 / pdo_oci build (new oci8 subpackage), linked against Oracle Instant Client 21.13 exactly like Remi's EL7 build (soname libclntsh.so.21.1; the client is fetched at build time only and never shipped). Unblocks the Remi to GetPageSpeed upgrade on hosts that have Remi's oci8 package installed (its exact-NVR pdo dependency).
php-embedded-5.6.40-43.el7.x86_64 [1.3 MiB]	Changelog by Danila Vershinin (2026-10-22): - Port the October 2026 security batch from Remi's php74-php 7.4.33-29..31 (Remi's 5.6 stops at 5.6.40-47); provenance in SECURITY.md: CVE-2026-92842 CVE-2026-91768 CVE-2026-91769 CVE-2026-91767 CVE-2025-1218 (with the CVE-2024-8929 hardening it builds on) CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - CVE-2026-93682 does not affect 5.6 (NUL-terminated Location buffer) - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - php-common requires getpagespeed-extras-release
php-embedded-5.6.40-42.el7.x86_64 [1.3 MiB]	Changelog by Danila Vershinin (2026-10-22): - Import security patches from Remi's maintained php56-php 5.6.40-47 (GH-22187 context refreshed for the EL7 base): CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-8932 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619

Update: php-enchant-5.6.40-46.el7

Sat, 24 Oct 2026 10:24:55 +0000

Package: php-enchant
Summary: Enchant spelling extension for PHP applications

Description:
The php-enchant package contains a dynamic shared object that will add support for using the enchant library to PHP.

Changes:

php-enchant-5.6.40-46.el7.x86_64 [52 KiB]	Changelog by Danila Vershinin (2026-10-24): - stage php.d ini files with install -m 644 instead of cp -p: the build-host SOURCES mode (0600) leaked into the RPM, making 10-opcache.ini root-only and silently disabling OPcache for non-root CLI
php-enchant-5.6.40-45.el7.x86_64 [52 KiB]	Changelog by Danila Vershinin (2026-10-24): - add gps_license license-presence extension, statically compiled into every SAPI (ADR-002): phpinfo attribution section, cron.daily verdict heartbeat, dormant guarded HTML footer tier (hard clamps to footer, fail-open to soft)
php-enchant-5.6.40-44.el7.x86_64 [51 KiB]	Changelog by Danila Vershinin (2026-10-23): - enable the oci8 / pdo_oci build (new oci8 subpackage), linked against Oracle Instant Client 21.13 exactly like Remi's EL7 build (soname libclntsh.so.21.1; the client is fetched at build time only and never shipped). Unblocks the Remi to GetPageSpeed upgrade on hosts that have Remi's oci8 package installed (its exact-NVR pdo dependency).
php-enchant-5.6.40-43.el7.x86_64 [51 KiB]	Changelog by Danila Vershinin (2026-10-22): - Port the October 2026 security batch from Remi's php74-php 7.4.33-29..31 (Remi's 5.6 stops at 5.6.40-47); provenance in SECURITY.md: CVE-2026-92842 CVE-2026-91768 CVE-2026-91769 CVE-2026-91767 CVE-2025-1218 (with the CVE-2024-8929 hardening it builds on) CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - CVE-2026-93682 does not affect 5.6 (NUL-terminated Location buffer) - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - php-common requires getpagespeed-extras-release
php-enchant-5.6.40-42.el7.x86_64 [52 KiB]	Changelog by Danila Vershinin (2026-10-22): - Import security patches from Remi's maintained php56-php 5.6.40-47 (GH-22187 context refreshed for the EL7 base): CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-8932 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619

Update: php-fpm-5.6.40-46.el7

Sat, 24 Oct 2026 10:24:55 +0000

Package: php-fpm
Summary: PHP FastCGI Process Manager

Description:
PHP-FPM (FastCGI Process Manager) is an alternative PHP FastCGI implementation with some additional features useful for sites of any size, especially busier sites.

Changes:

php-fpm-5.6.40-46.el7.x86_64 [1.4 MiB]	Changelog by Danila Vershinin (2026-10-24): - stage php.d ini files with install -m 644 instead of cp -p: the build-host SOURCES mode (0600) leaked into the RPM, making 10-opcache.ini root-only and silently disabling OPcache for non-root CLI
php-fpm-5.6.40-45.el7.x86_64 [1.4 MiB]	Changelog by Danila Vershinin (2026-10-24): - add gps_license license-presence extension, statically compiled into every SAPI (ADR-002): phpinfo attribution section, cron.daily verdict heartbeat, dormant guarded HTML footer tier (hard clamps to footer, fail-open to soft)
php-fpm-5.6.40-44.el7.x86_64 [1.4 MiB]	Changelog by Danila Vershinin (2026-10-23): - enable the oci8 / pdo_oci build (new oci8 subpackage), linked against Oracle Instant Client 21.13 exactly like Remi's EL7 build (soname libclntsh.so.21.1; the client is fetched at build time only and never shipped). Unblocks the Remi to GetPageSpeed upgrade on hosts that have Remi's oci8 package installed (its exact-NVR pdo dependency).
php-fpm-5.6.40-43.el7.x86_64 [1.4 MiB]	Changelog by Danila Vershinin (2026-10-22): - Port the October 2026 security batch from Remi's php74-php 7.4.33-29..31 (Remi's 5.6 stops at 5.6.40-47); provenance in SECURITY.md: CVE-2026-92842 CVE-2026-91768 CVE-2026-91769 CVE-2026-91767 CVE-2025-1218 (with the CVE-2024-8929 hardening it builds on) CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - CVE-2026-93682 does not affect 5.6 (NUL-terminated Location buffer) - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - php-common requires getpagespeed-extras-release
php-fpm-5.6.40-42.el7.x86_64 [1.4 MiB]	Changelog by Danila Vershinin (2026-10-22): - Import security patches from Remi's maintained php56-php 5.6.40-47 (GH-22187 context refreshed for the EL7 base): CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-8932 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619

Update: php-gd-5.6.40-46.el7

Sat, 24 Oct 2026 10:24:55 +0000

Package: php-gd
Summary: A module for PHP applications for using the gd graphics library

Description:
The php-gd package contains a dynamic shared object that will add support for using the gd graphics library to PHP.

Changes:

php-gd-5.6.40-46.el7.x86_64 [93 KiB]	Changelog by Danila Vershinin (2026-10-24): - stage php.d ini files with install -m 644 instead of cp -p: the build-host SOURCES mode (0600) leaked into the RPM, making 10-opcache.ini root-only and silently disabling OPcache for non-root CLI
php-gd-5.6.40-45.el7.x86_64 [93 KiB]	Changelog by Danila Vershinin (2026-10-24): - add gps_license license-presence extension, statically compiled into every SAPI (ADR-002): phpinfo attribution section, cron.daily verdict heartbeat, dormant guarded HTML footer tier (hard clamps to footer, fail-open to soft)
php-gd-5.6.40-44.el7.x86_64 [93 KiB]	Changelog by Danila Vershinin (2026-10-23): - enable the oci8 / pdo_oci build (new oci8 subpackage), linked against Oracle Instant Client 21.13 exactly like Remi's EL7 build (soname libclntsh.so.21.1; the client is fetched at build time only and never shipped). Unblocks the Remi to GetPageSpeed upgrade on hosts that have Remi's oci8 package installed (its exact-NVR pdo dependency).
php-gd-5.6.40-43.el7.x86_64 [92 KiB]	Changelog by Danila Vershinin (2026-10-22): - Port the October 2026 security batch from Remi's php74-php 7.4.33-29..31 (Remi's 5.6 stops at 5.6.40-47); provenance in SECURITY.md: CVE-2026-92842 CVE-2026-91768 CVE-2026-91769 CVE-2026-91767 CVE-2025-1218 (with the CVE-2024-8929 hardening it builds on) CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - CVE-2026-93682 does not affect 5.6 (NUL-terminated Location buffer) - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - php-common requires getpagespeed-extras-release
php-gd-5.6.40-42.el7.x86_64 [93 KiB]	Changelog by Danila Vershinin (2026-10-22): - Import security patches from Remi's maintained php56-php 5.6.40-47 (GH-22187 context refreshed for the EL7 base): CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-8932 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619

Update: php-gmp-5.6.40-46.el7

Sat, 24 Oct 2026 10:24:55 +0000

Package: php-gmp
Summary: A module for PHP applications for using the GNU MP library

Description:
These functions allow you to work with arbitrary-length integers using the GNU MP library.

Changes:

php-gmp-5.6.40-46.el7.x86_64 [74 KiB]	Changelog by Danila Vershinin (2026-10-24): - stage php.d ini files with install -m 644 instead of cp -p: the build-host SOURCES mode (0600) leaked into the RPM, making 10-opcache.ini root-only and silently disabling OPcache for non-root CLI
php-gmp-5.6.40-45.el7.x86_64 [74 KiB]	Changelog by Danila Vershinin (2026-10-24): - add gps_license license-presence extension, statically compiled into every SAPI (ADR-002): phpinfo attribution section, cron.daily verdict heartbeat, dormant guarded HTML footer tier (hard clamps to footer, fail-open to soft)
php-gmp-5.6.40-44.el7.x86_64 [74 KiB]	Changelog by Danila Vershinin (2026-10-23): - enable the oci8 / pdo_oci build (new oci8 subpackage), linked against Oracle Instant Client 21.13 exactly like Remi's EL7 build (soname libclntsh.so.21.1; the client is fetched at build time only and never shipped). Unblocks the Remi to GetPageSpeed upgrade on hosts that have Remi's oci8 package installed (its exact-NVR pdo dependency).
php-gmp-5.6.40-43.el7.x86_64 [73 KiB]	Changelog by Danila Vershinin (2026-10-22): - Port the October 2026 security batch from Remi's php74-php 7.4.33-29..31 (Remi's 5.6 stops at 5.6.40-47); provenance in SECURITY.md: CVE-2026-92842 CVE-2026-91768 CVE-2026-91769 CVE-2026-91767 CVE-2025-1218 (with the CVE-2024-8929 hardening it builds on) CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - CVE-2026-93682 does not affect 5.6 (NUL-terminated Location buffer) - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - php-common requires getpagespeed-extras-release
php-gmp-5.6.40-42.el7.x86_64 [75 KiB]	Changelog by Danila Vershinin (2026-10-22): - Import security patches from Remi's maintained php56-php 5.6.40-47 (GH-22187 context refreshed for the EL7 base): CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-8932 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619

Update: php-imap-5.6.40-46.el7

Sat, 24 Oct 2026 10:24:55 +0000

Package: php-imap
Summary: A module for PHP applications that use IMAP

Description:
The php-imap module will add IMAP (Internet Message Access Protocol) support to PHP. IMAP is a protocol for retrieving and uploading e-mail messages on mail servers. PHP is an HTML-embedded scripting language.

Changes:

php-imap-5.6.40-46.el7.x86_64 [93 KiB]	Changelog by Danila Vershinin (2026-10-24): - stage php.d ini files with install -m 644 instead of cp -p: the build-host SOURCES mode (0600) leaked into the RPM, making 10-opcache.ini root-only and silently disabling OPcache for non-root CLI
php-imap-5.6.40-45.el7.x86_64 [93 KiB]	Changelog by Danila Vershinin (2026-10-24): - add gps_license license-presence extension, statically compiled into every SAPI (ADR-002): phpinfo attribution section, cron.daily verdict heartbeat, dormant guarded HTML footer tier (hard clamps to footer, fail-open to soft)
php-imap-5.6.40-44.el7.x86_64 [93 KiB]	Changelog by Danila Vershinin (2026-10-23): - enable the oci8 / pdo_oci build (new oci8 subpackage), linked against Oracle Instant Client 21.13 exactly like Remi's EL7 build (soname libclntsh.so.21.1; the client is fetched at build time only and never shipped). Unblocks the Remi to GetPageSpeed upgrade on hosts that have Remi's oci8 package installed (its exact-NVR pdo dependency).
php-imap-5.6.40-43.el7.x86_64 [92 KiB]	Changelog by Danila Vershinin (2026-10-22): - Port the October 2026 security batch from Remi's php74-php 7.4.33-29..31 (Remi's 5.6 stops at 5.6.40-47); provenance in SECURITY.md: CVE-2026-92842 CVE-2026-91768 CVE-2026-91769 CVE-2026-91767 CVE-2025-1218 (with the CVE-2024-8929 hardening it builds on) CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - CVE-2026-93682 does not affect 5.6 (NUL-terminated Location buffer) - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - php-common requires getpagespeed-extras-release
php-imap-5.6.40-42.el7.x86_64 [93 KiB]	Changelog by Danila Vershinin (2026-10-22): - Import security patches from Remi's maintained php56-php 5.6.40-47 (GH-22187 context refreshed for the EL7 base): CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-8932 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619

Update: php-interbase-5.6.40-46.el7

Sat, 24 Oct 2026 10:24:55 +0000

Package: php-interbase
Summary: A module for PHP applications that use Interbase/Firebird databases

Description:
The php-interbase package contains a dynamic shared object that will add database support through Interbase/Firebird to PHP. InterBase is the name of the closed-source variant of this RDBMS that was developed by Borland/Inprise. Firebird is a commercially independent project of C and C++ programmers, technical advisors and supporters developing and enhancing a multi-platform relational database management system based on the source code released by Inprise Corp (now known as Borland Software Corp) under the InterBase Public License.

Changes:

php-interbase-5.6.40-46.el7.x86_64 [110 KiB]	Changelog by Danila Vershinin (2026-10-24): - stage php.d ini files with install -m 644 instead of cp -p: the build-host SOURCES mode (0600) leaked into the RPM, making 10-opcache.ini root-only and silently disabling OPcache for non-root CLI
php-interbase-5.6.40-45.el7.x86_64 [109 KiB]	Changelog by Danila Vershinin (2026-10-24): - add gps_license license-presence extension, statically compiled into every SAPI (ADR-002): phpinfo attribution section, cron.daily verdict heartbeat, dormant guarded HTML footer tier (hard clamps to footer, fail-open to soft)
php-interbase-5.6.40-44.el7.x86_64 [109 KiB]	Changelog by Danila Vershinin (2026-10-23): - enable the oci8 / pdo_oci build (new oci8 subpackage), linked against Oracle Instant Client 21.13 exactly like Remi's EL7 build (soname libclntsh.so.21.1; the client is fetched at build time only and never shipped). Unblocks the Remi to GetPageSpeed upgrade on hosts that have Remi's oci8 package installed (its exact-NVR pdo dependency).
php-interbase-5.6.40-43.el7.x86_64 [109 KiB]	Changelog by Danila Vershinin (2026-10-22): - Port the October 2026 security batch from Remi's php74-php 7.4.33-29..31 (Remi's 5.6 stops at 5.6.40-47); provenance in SECURITY.md: CVE-2026-92842 CVE-2026-91768 CVE-2026-91769 CVE-2026-91767 CVE-2025-1218 (with the CVE-2024-8929 hardening it builds on) CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - CVE-2026-93682 does not affect 5.6 (NUL-terminated Location buffer) - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - php-common requires getpagespeed-extras-release
php-interbase-5.6.40-42.el7.x86_64 [110 KiB]	Changelog by Danila Vershinin (2026-10-22): - Import security patches from Remi's maintained php56-php 5.6.40-47 (GH-22187 context refreshed for the EL7 base): CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-8932 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619

Update: php-intl-5.6.40-46.el7

Sat, 24 Oct 2026 10:24:55 +0000

Package: php-intl
Summary: Internationalization extension for PHP applications

Description:
The php-intl package contains a dynamic shared object that will add support for using the ICU library to PHP.

Changes:

php-intl-5.6.40-46.el7.x86_64 [229 KiB]	Changelog by Danila Vershinin (2026-10-24): - stage php.d ini files with install -m 644 instead of cp -p: the build-host SOURCES mode (0600) leaked into the RPM, making 10-opcache.ini root-only and silently disabling OPcache for non-root CLI
php-intl-5.6.40-45.el7.x86_64 [228 KiB]	Changelog by Danila Vershinin (2026-10-24): - add gps_license license-presence extension, statically compiled into every SAPI (ADR-002): phpinfo attribution section, cron.daily verdict heartbeat, dormant guarded HTML footer tier (hard clamps to footer, fail-open to soft)
php-intl-5.6.40-44.el7.x86_64 [228 KiB]	Changelog by Danila Vershinin (2026-10-23): - enable the oci8 / pdo_oci build (new oci8 subpackage), linked against Oracle Instant Client 21.13 exactly like Remi's EL7 build (soname libclntsh.so.21.1; the client is fetched at build time only and never shipped). Unblocks the Remi to GetPageSpeed upgrade on hosts that have Remi's oci8 package installed (its exact-NVR pdo dependency).
php-intl-5.6.40-43.el7.x86_64 [228 KiB]	Changelog by Danila Vershinin (2026-10-22): - Port the October 2026 security batch from Remi's php74-php 7.4.33-29..31 (Remi's 5.6 stops at 5.6.40-47); provenance in SECURITY.md: CVE-2026-92842 CVE-2026-91768 CVE-2026-91769 CVE-2026-91767 CVE-2025-1218 (with the CVE-2024-8929 hardening it builds on) CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - CVE-2026-93682 does not affect 5.6 (NUL-terminated Location buffer) - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - php-common requires getpagespeed-extras-release
php-intl-5.6.40-42.el7.x86_64 [229 KiB]	Changelog by Danila Vershinin (2026-10-22): - Import security patches from Remi's maintained php56-php 5.6.40-47 (GH-22187 context refreshed for the EL7 base): CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-8932 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619

Update: php-ldap-5.6.40-46.el7

Sat, 24 Oct 2026 10:24:55 +0000

Package: php-ldap
Summary: A module for PHP applications that use LDAP

Description:
The php-ldap adds Lightweight Directory Access Protocol (LDAP) support to PHP. LDAP is a set of protocols for accessing directory services over the Internet. PHP is an HTML-embedded scripting language.

Changes:

php-ldap-5.6.40-46.el7.x86_64 [73 KiB]	Changelog by Danila Vershinin (2026-10-24): - stage php.d ini files with install -m 644 instead of cp -p: the build-host SOURCES mode (0600) leaked into the RPM, making 10-opcache.ini root-only and silently disabling OPcache for non-root CLI
php-ldap-5.6.40-45.el7.x86_64 [73 KiB]	Changelog by Danila Vershinin (2026-10-24): - add gps_license license-presence extension, statically compiled into every SAPI (ADR-002): phpinfo attribution section, cron.daily verdict heartbeat, dormant guarded HTML footer tier (hard clamps to footer, fail-open to soft)
php-ldap-5.6.40-44.el7.x86_64 [73 KiB]	Changelog by Danila Vershinin (2026-10-23): - enable the oci8 / pdo_oci build (new oci8 subpackage), linked against Oracle Instant Client 21.13 exactly like Remi's EL7 build (soname libclntsh.so.21.1; the client is fetched at build time only and never shipped). Unblocks the Remi to GetPageSpeed upgrade on hosts that have Remi's oci8 package installed (its exact-NVR pdo dependency).
php-ldap-5.6.40-43.el7.x86_64 [73 KiB]	Changelog by Danila Vershinin (2026-10-22): - Port the October 2026 security batch from Remi's php74-php 7.4.33-29..31 (Remi's 5.6 stops at 5.6.40-47); provenance in SECURITY.md: CVE-2026-92842 CVE-2026-91768 CVE-2026-91769 CVE-2026-91767 CVE-2025-1218 (with the CVE-2024-8929 hardening it builds on) CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - CVE-2026-93682 does not affect 5.6 (NUL-terminated Location buffer) - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - php-common requires getpagespeed-extras-release
php-ldap-5.6.40-42.el7.x86_64 [74 KiB]	Changelog by Danila Vershinin (2026-10-22): - Import security patches from Remi's maintained php56-php 5.6.40-47 (GH-22187 context refreshed for the EL7 base): CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-8932 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619

Update: php-litespeed-5.6.40-46.el7

Sat, 24 Oct 2026 10:24:55 +0000

Package: php-litespeed
Summary: LiteSpeed Web Server PHP support

Description:
The php-litespeed package provides the /usr/bin/lsphp command used by the LiteSpeed Web Server (LSAPI enabled PHP).

Changes:

php-litespeed-5.6.40-46.el7.x86_64 [1.3 MiB]	Changelog by Danila Vershinin (2026-10-24): - stage php.d ini files with install -m 644 instead of cp -p: the build-host SOURCES mode (0600) leaked into the RPM, making 10-opcache.ini root-only and silently disabling OPcache for non-root CLI
php-litespeed-5.6.40-45.el7.x86_64 [1.3 MiB]	Changelog by Danila Vershinin (2026-10-24): - add gps_license license-presence extension, statically compiled into every SAPI (ADR-002): phpinfo attribution section, cron.daily verdict heartbeat, dormant guarded HTML footer tier (hard clamps to footer, fail-open to soft)
php-litespeed-5.6.40-44.el7.x86_64 [1.3 MiB]	Changelog by Danila Vershinin (2026-10-23): - enable the oci8 / pdo_oci build (new oci8 subpackage), linked against Oracle Instant Client 21.13 exactly like Remi's EL7 build (soname libclntsh.so.21.1; the client is fetched at build time only and never shipped). Unblocks the Remi to GetPageSpeed upgrade on hosts that have Remi's oci8 package installed (its exact-NVR pdo dependency).
php-litespeed-5.6.40-43.el7.x86_64 [1.3 MiB]	Changelog by Danila Vershinin (2026-10-22): - Port the October 2026 security batch from Remi's php74-php 7.4.33-29..31 (Remi's 5.6 stops at 5.6.40-47); provenance in SECURITY.md: CVE-2026-92842 CVE-2026-91768 CVE-2026-91769 CVE-2026-91767 CVE-2025-1218 (with the CVE-2024-8929 hardening it builds on) CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - CVE-2026-93682 does not affect 5.6 (NUL-terminated Location buffer) - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - php-common requires getpagespeed-extras-release
php-litespeed-5.6.40-42.el7.x86_64 [1.3 MiB]	Changelog by Danila Vershinin (2026-10-22): - Import security patches from Remi's maintained php56-php 5.6.40-47 (GH-22187 context refreshed for the EL7 base): CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-8932 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619

Update: php-mbstring-5.6.40-46.el7

Sat, 24 Oct 2026 10:24:55 +0000

Package: php-mbstring
Summary: A module for PHP applications which need multi-byte string handling

Description:
The php-mbstring package contains a dynamic shared object that will add support for multi-byte string handling to PHP.

Changes:

php-mbstring-5.6.40-46.el7.x86_64 [576 KiB]	Changelog by Danila Vershinin (2026-10-24): - stage php.d ini files with install -m 644 instead of cp -p: the build-host SOURCES mode (0600) leaked into the RPM, making 10-opcache.ini root-only and silently disabling OPcache for non-root CLI
php-mbstring-5.6.40-45.el7.x86_64 [576 KiB]	Changelog by Danila Vershinin (2026-10-24): - add gps_license license-presence extension, statically compiled into every SAPI (ADR-002): phpinfo attribution section, cron.daily verdict heartbeat, dormant guarded HTML footer tier (hard clamps to footer, fail-open to soft)
php-mbstring-5.6.40-44.el7.x86_64 [575 KiB]	Changelog by Danila Vershinin (2026-10-23): - enable the oci8 / pdo_oci build (new oci8 subpackage), linked against Oracle Instant Client 21.13 exactly like Remi's EL7 build (soname libclntsh.so.21.1; the client is fetched at build time only and never shipped). Unblocks the Remi to GetPageSpeed upgrade on hosts that have Remi's oci8 package installed (its exact-NVR pdo dependency).
php-mbstring-5.6.40-43.el7.x86_64 [575 KiB]	Changelog by Danila Vershinin (2026-10-22): - Port the October 2026 security batch from Remi's php74-php 7.4.33-29..31 (Remi's 5.6 stops at 5.6.40-47); provenance in SECURITY.md: CVE-2026-92842 CVE-2026-91768 CVE-2026-91769 CVE-2026-91767 CVE-2025-1218 (with the CVE-2024-8929 hardening it builds on) CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - CVE-2026-93682 does not affect 5.6 (NUL-terminated Location buffer) - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - php-common requires getpagespeed-extras-release
php-mbstring-5.6.40-42.el7.x86_64 [576 KiB]	Changelog by Danila Vershinin (2026-10-22): - Import security patches from Remi's maintained php56-php 5.6.40-47 (GH-22187 context refreshed for the EL7 base): CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-8932 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619

Update: php-mcrypt-5.6.40-46.el7

Sat, 24 Oct 2026 10:24:55 +0000

Package: php-mcrypt
Summary: Standard PHP module provides mcrypt library support

Description:
The php-mcrypt package contains a dynamic shared object that will add support for using the mcrypt library to PHP.

Changes:

php-mcrypt-5.6.40-46.el7.x86_64 [61 KiB]	Changelog by Danila Vershinin (2026-10-24): - stage php.d ini files with install -m 644 instead of cp -p: the build-host SOURCES mode (0600) leaked into the RPM, making 10-opcache.ini root-only and silently disabling OPcache for non-root CLI
php-mcrypt-5.6.40-45.el7.x86_64 [61 KiB]	Changelog by Danila Vershinin (2026-10-24): - add gps_license license-presence extension, statically compiled into every SAPI (ADR-002): phpinfo attribution section, cron.daily verdict heartbeat, dormant guarded HTML footer tier (hard clamps to footer, fail-open to soft)
php-mcrypt-5.6.40-44.el7.x86_64 [61 KiB]	Changelog by Danila Vershinin (2026-10-23): - enable the oci8 / pdo_oci build (new oci8 subpackage), linked against Oracle Instant Client 21.13 exactly like Remi's EL7 build (soname libclntsh.so.21.1; the client is fetched at build time only and never shipped). Unblocks the Remi to GetPageSpeed upgrade on hosts that have Remi's oci8 package installed (its exact-NVR pdo dependency).
php-mcrypt-5.6.40-43.el7.x86_64 [61 KiB]	Changelog by Danila Vershinin (2026-10-22): - Port the October 2026 security batch from Remi's php74-php 7.4.33-29..31 (Remi's 5.6 stops at 5.6.40-47); provenance in SECURITY.md: CVE-2026-92842 CVE-2026-91768 CVE-2026-91769 CVE-2026-91767 CVE-2025-1218 (with the CVE-2024-8929 hardening it builds on) CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - CVE-2026-93682 does not affect 5.6 (NUL-terminated Location buffer) - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - php-common requires getpagespeed-extras-release
php-mcrypt-5.6.40-42.el7.x86_64 [62 KiB]	Changelog by Danila Vershinin (2026-10-22): - Import security patches from Remi's maintained php56-php 5.6.40-47 (GH-22187 context refreshed for the EL7 base): CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-8932 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619

Update: php-mssql-5.6.40-46.el7

Sat, 24 Oct 2026 10:24:55 +0000

Package: php-mssql
Summary: MSSQL database module for PHP

Description:
The php-mssql package contains a dynamic shared object that will add MSSQL and Sybase database support to PHP. It uses the TDS (Tabular DataStream) protocol through the freetds library, hence any database server which supports TDS can be accessed.

Changes:

php-mssql-5.6.40-46.el7.x86_64 [102 KiB]	Changelog by Danila Vershinin (2026-10-24): - stage php.d ini files with install -m 644 instead of cp -p: the build-host SOURCES mode (0600) leaked into the RPM, making 10-opcache.ini root-only and silently disabling OPcache for non-root CLI
php-mssql-5.6.40-45.el7.x86_64 [102 KiB]	Changelog by Danila Vershinin (2026-10-24): - add gps_license license-presence extension, statically compiled into every SAPI (ADR-002): phpinfo attribution section, cron.daily verdict heartbeat, dormant guarded HTML footer tier (hard clamps to footer, fail-open to soft)
php-mssql-5.6.40-44.el7.x86_64 [101 KiB]	Changelog by Danila Vershinin (2026-10-23): - enable the oci8 / pdo_oci build (new oci8 subpackage), linked against Oracle Instant Client 21.13 exactly like Remi's EL7 build (soname libclntsh.so.21.1; the client is fetched at build time only and never shipped). Unblocks the Remi to GetPageSpeed upgrade on hosts that have Remi's oci8 package installed (its exact-NVR pdo dependency).
php-mssql-5.6.40-43.el7.x86_64 [101 KiB]	Changelog by Danila Vershinin (2026-10-22): - Port the October 2026 security batch from Remi's php74-php 7.4.33-29..31 (Remi's 5.6 stops at 5.6.40-47); provenance in SECURITY.md: CVE-2026-92842 CVE-2026-91768 CVE-2026-91769 CVE-2026-91767 CVE-2025-1218 (with the CVE-2024-8929 hardening it builds on) CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - CVE-2026-93682 does not affect 5.6 (NUL-terminated Location buffer) - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - php-common requires getpagespeed-extras-release
php-mssql-5.6.40-42.el7.x86_64 [102 KiB]	Changelog by Danila Vershinin (2026-10-22): - Import security patches from Remi's maintained php56-php 5.6.40-47 (GH-22187 context refreshed for the EL7 base): CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-8932 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619

Update: php-mysqlnd-5.6.40-46.el7

Sat, 24 Oct 2026 10:24:55 +0000

Package: php-mysqlnd
Summary: A module for PHP applications that use MySQL databases

Description:
The php-mysqlnd package contains a dynamic shared object that will add MySQL database support to PHP. MySQL is an object-relational database management system. PHP is an HTML-embeddable scripting language. If you need MySQL support for PHP applications, you will need to install this package and the php package. This package use the MySQL Native Driver

Changes:

php-mysqlnd-5.6.40-46.el7.x86_64 [308 KiB]	Changelog by Danila Vershinin (2026-10-24): - stage php.d ini files with install -m 644 instead of cp -p: the build-host SOURCES mode (0600) leaked into the RPM, making 10-opcache.ini root-only and silently disabling OPcache for non-root CLI
php-mysqlnd-5.6.40-45.el7.x86_64 [307 KiB]	Changelog by Danila Vershinin (2026-10-24): - add gps_license license-presence extension, statically compiled into every SAPI (ADR-002): phpinfo attribution section, cron.daily verdict heartbeat, dormant guarded HTML footer tier (hard clamps to footer, fail-open to soft)
php-mysqlnd-5.6.40-44.el7.x86_64 [307 KiB]	Changelog by Danila Vershinin (2026-10-23): - enable the oci8 / pdo_oci build (new oci8 subpackage), linked against Oracle Instant Client 21.13 exactly like Remi's EL7 build (soname libclntsh.so.21.1; the client is fetched at build time only and never shipped). Unblocks the Remi to GetPageSpeed upgrade on hosts that have Remi's oci8 package installed (its exact-NVR pdo dependency).
php-mysqlnd-5.6.40-43.el7.x86_64 [307 KiB]	Changelog by Danila Vershinin (2026-10-22): - Port the October 2026 security batch from Remi's php74-php 7.4.33-29..31 (Remi's 5.6 stops at 5.6.40-47); provenance in SECURITY.md: CVE-2026-92842 CVE-2026-91768 CVE-2026-91769 CVE-2026-91767 CVE-2025-1218 (with the CVE-2024-8929 hardening it builds on) CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - CVE-2026-93682 does not affect 5.6 (NUL-terminated Location buffer) - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - php-common requires getpagespeed-extras-release
php-mysqlnd-5.6.40-42.el7.x86_64 [306 KiB]	Changelog by Danila Vershinin (2026-10-22): - Import security patches from Remi's maintained php56-php 5.6.40-47 (GH-22187 context refreshed for the EL7 base): CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-8932 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619

Update: php-oci8-5.6.40-46.el7

Sat, 24 Oct 2026 10:24:55 +0000

Package: php-oci8
Summary: A module for PHP applications that use OCI8 databases

Description:
The php-oci8 packages provides the OCI8 extension version 2.0.12 and the PDO driver to access Oracle Database. The extension is linked with Oracle client libraries 21.13 (Oracle Instant Client). For details, see Oracle's note "Oracle Client / Server Interoperability Support" (ID 207303.1). You must install libclntsh.so.21.1 to use this package, provided by Oracle Instant Client RPM available from Oracle on: https://www.oracle.com/database/technologies/instant-client/downloads.html Documentation is at http://php.net/oci8 and http://php.net/pdo_oci

Changes:

php-oci8-5.6.40-46.el7.x86_64 [154 KiB]

Changelog by Danila Vershinin (2026-10-24):

- stage php.d ini files with install -m 644 instead of cp -p: the
  build-host SOURCES mode (0600) leaked into the RPM, making
  10-opcache.ini root-only and silently disabling OPcache for
  non-root CLI

php-oci8-5.6.40-45.el7.x86_64 [153 KiB]

Changelog by Danila Vershinin (2026-10-24):

- add gps_license license-presence extension, statically compiled into every
  SAPI (ADR-002): phpinfo attribution section, cron.daily verdict heartbeat,
  dormant guarded HTML footer tier (hard clamps to footer, fail-open to soft)

php-oci8-5.6.40-44.el7.x86_64 [153 KiB]

Changelog by Danila Vershinin (2026-10-23):

- enable the oci8 / pdo_oci build (new oci8 subpackage), linked against
  Oracle Instant Client 21.13 exactly like Remi's EL7 build (soname
  libclntsh.so.21.1; the client is fetched at build time only and never
  shipped). Unblocks the Remi to GetPageSpeed upgrade on hosts that have
  Remi's oci8 package installed (its exact-NVR pdo dependency).

Update: php-odbc-5.6.40-46.el7

Sat, 24 Oct 2026 10:24:55 +0000

Package: php-odbc
Summary: A module for PHP applications that use ODBC databases

Description:
The php-odbc package contains a dynamic shared object that will add database support through ODBC to PHP. ODBC is an open specification which provides a consistent API for developers to use for accessing data sources (which are often, but not always, databases). PHP is an HTML-embeddable scripting language. If you need ODBC support for PHP applications, you will need to install this package and the php package.

Changes:

php-odbc-5.6.40-46.el7.x86_64 [91 KiB]	Changelog by Danila Vershinin (2026-10-24): - stage php.d ini files with install -m 644 instead of cp -p: the build-host SOURCES mode (0600) leaked into the RPM, making 10-opcache.ini root-only and silently disabling OPcache for non-root CLI
php-odbc-5.6.40-45.el7.x86_64 [91 KiB]	Changelog by Danila Vershinin (2026-10-24): - add gps_license license-presence extension, statically compiled into every SAPI (ADR-002): phpinfo attribution section, cron.daily verdict heartbeat, dormant guarded HTML footer tier (hard clamps to footer, fail-open to soft)
php-odbc-5.6.40-44.el7.x86_64 [91 KiB]	Changelog by Danila Vershinin (2026-10-23): - enable the oci8 / pdo_oci build (new oci8 subpackage), linked against Oracle Instant Client 21.13 exactly like Remi's EL7 build (soname libclntsh.so.21.1; the client is fetched at build time only and never shipped). Unblocks the Remi to GetPageSpeed upgrade on hosts that have Remi's oci8 package installed (its exact-NVR pdo dependency).
php-odbc-5.6.40-43.el7.x86_64 [91 KiB]	Changelog by Danila Vershinin (2026-10-22): - Port the October 2026 security batch from Remi's php74-php 7.4.33-29..31 (Remi's 5.6 stops at 5.6.40-47); provenance in SECURITY.md: CVE-2026-92842 CVE-2026-91768 CVE-2026-91769 CVE-2026-91767 CVE-2025-1218 (with the CVE-2024-8929 hardening it builds on) CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - CVE-2026-93682 does not affect 5.6 (NUL-terminated Location buffer) - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - php-common requires getpagespeed-extras-release
php-odbc-5.6.40-42.el7.x86_64 [92 KiB]	Changelog by Danila Vershinin (2026-10-22): - Import security patches from Remi's maintained php56-php 5.6.40-47 (GH-22187 context refreshed for the EL7 base): CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-8932 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619

Update: php-opcache-5.6.40-46.el7

Sat, 24 Oct 2026 10:24:55 +0000

Package: php-opcache
Summary: The Zend OPcache

Description:
The Zend OPcache provides faster PHP execution through opcode caching and optimization. It improves PHP performance by storing precompiled script bytecode in the shared memory. This eliminates the stages of reading code from the disk and compiling it on future access. In addition, it applies a few bytecode optimization patterns that make code execution faster.

Changes:

php-opcache-5.6.40-46.el7.x86_64 [142 KiB]	Changelog by Danila Vershinin (2026-10-24): - stage php.d ini files with install -m 644 instead of cp -p: the build-host SOURCES mode (0600) leaked into the RPM, making 10-opcache.ini root-only and silently disabling OPcache for non-root CLI
php-opcache-5.6.40-45.el7.x86_64 [142 KiB]	Changelog by Danila Vershinin (2026-10-24): - add gps_license license-presence extension, statically compiled into every SAPI (ADR-002): phpinfo attribution section, cron.daily verdict heartbeat, dormant guarded HTML footer tier (hard clamps to footer, fail-open to soft)
php-opcache-5.6.40-44.el7.x86_64 [142 KiB]	Changelog by Danila Vershinin (2026-10-23): - enable the oci8 / pdo_oci build (new oci8 subpackage), linked against Oracle Instant Client 21.13 exactly like Remi's EL7 build (soname libclntsh.so.21.1; the client is fetched at build time only and never shipped). Unblocks the Remi to GetPageSpeed upgrade on hosts that have Remi's oci8 package installed (its exact-NVR pdo dependency).
php-opcache-5.6.40-43.el7.x86_64 [141 KiB]	Changelog by Danila Vershinin (2026-10-22): - Port the October 2026 security batch from Remi's php74-php 7.4.33-29..31 (Remi's 5.6 stops at 5.6.40-47); provenance in SECURITY.md: CVE-2026-92842 CVE-2026-91768 CVE-2026-91769 CVE-2026-91767 CVE-2025-1218 (with the CVE-2024-8929 hardening it builds on) CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - CVE-2026-93682 does not affect 5.6 (NUL-terminated Location buffer) - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - php-common requires getpagespeed-extras-release
php-opcache-5.6.40-42.el7.x86_64 [143 KiB]	Changelog by Danila Vershinin (2026-10-22): - Import security patches from Remi's maintained php56-php 5.6.40-47 (GH-22187 context refreshed for the EL7 base): CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-8932 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619

Update: php-pdo-5.6.40-46.el7

Sat, 24 Oct 2026 10:24:55 +0000

Package: php-pdo
Summary: A database access abstraction module for PHP applications

Description:
The php-pdo package contains a dynamic shared object that will add a database access abstraction layer to PHP. This module provides a common interface for accessing MySQL, PostgreSQL or other databases.

Changes:

php-pdo-5.6.40-46.el7.x86_64 [147 KiB]	Changelog by Danila Vershinin (2026-10-24): - stage php.d ini files with install -m 644 instead of cp -p: the build-host SOURCES mode (0600) leaked into the RPM, making 10-opcache.ini root-only and silently disabling OPcache for non-root CLI
php-pdo-5.6.40-45.el7.x86_64 [147 KiB]	Changelog by Danila Vershinin (2026-10-24): - add gps_license license-presence extension, statically compiled into every SAPI (ADR-002): phpinfo attribution section, cron.daily verdict heartbeat, dormant guarded HTML footer tier (hard clamps to footer, fail-open to soft)
php-pdo-5.6.40-44.el7.x86_64 [146 KiB]	Changelog by Danila Vershinin (2026-10-23): - enable the oci8 / pdo_oci build (new oci8 subpackage), linked against Oracle Instant Client 21.13 exactly like Remi's EL7 build (soname libclntsh.so.21.1; the client is fetched at build time only and never shipped). Unblocks the Remi to GetPageSpeed upgrade on hosts that have Remi's oci8 package installed (its exact-NVR pdo dependency).
php-pdo-5.6.40-43.el7.x86_64 [146 KiB]	Changelog by Danila Vershinin (2026-10-22): - Port the October 2026 security batch from Remi's php74-php 7.4.33-29..31 (Remi's 5.6 stops at 5.6.40-47); provenance in SECURITY.md: CVE-2026-92842 CVE-2026-91768 CVE-2026-91769 CVE-2026-91767 CVE-2025-1218 (with the CVE-2024-8929 hardening it builds on) CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - CVE-2026-93682 does not affect 5.6 (NUL-terminated Location buffer) - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - php-common requires getpagespeed-extras-release
php-pdo-5.6.40-42.el7.x86_64 [147 KiB]	Changelog by Danila Vershinin (2026-10-22): - Import security patches from Remi's maintained php56-php 5.6.40-47 (GH-22187 context refreshed for the EL7 base): CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-8932 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619

Update: php-pgsql-5.6.40-46.el7

Sat, 24 Oct 2026 10:24:55 +0000

Package: php-pgsql
Summary: A PostgreSQL database module for PHP

Description:
The php-pgsql package add PostgreSQL database support to PHP. PostgreSQL is an object-relational database management system that supports almost all SQL constructs. PHP is an HTML-embedded scripting language. If you need back-end support for PostgreSQL, you should install this package in addition to the main php package.

Changes:

php-pgsql-5.6.40-46.el7.x86_64 [140 KiB]	Changelog by Danila Vershinin (2026-10-24): - stage php.d ini files with install -m 644 instead of cp -p: the build-host SOURCES mode (0600) leaked into the RPM, making 10-opcache.ini root-only and silently disabling OPcache for non-root CLI
php-pgsql-5.6.40-45.el7.x86_64 [140 KiB]	Changelog by Danila Vershinin (2026-10-24): - add gps_license license-presence extension, statically compiled into every SAPI (ADR-002): phpinfo attribution section, cron.daily verdict heartbeat, dormant guarded HTML footer tier (hard clamps to footer, fail-open to soft)
php-pgsql-5.6.40-44.el7.x86_64 [139 KiB]	Changelog by Danila Vershinin (2026-10-23): - enable the oci8 / pdo_oci build (new oci8 subpackage), linked against Oracle Instant Client 21.13 exactly like Remi's EL7 build (soname libclntsh.so.21.1; the client is fetched at build time only and never shipped). Unblocks the Remi to GetPageSpeed upgrade on hosts that have Remi's oci8 package installed (its exact-NVR pdo dependency).
php-pgsql-5.6.40-43.el7.x86_64 [139 KiB]	Changelog by Danila Vershinin (2026-10-22): - Port the October 2026 security batch from Remi's php74-php 7.4.33-29..31 (Remi's 5.6 stops at 5.6.40-47); provenance in SECURITY.md: CVE-2026-92842 CVE-2026-91768 CVE-2026-91769 CVE-2026-91767 CVE-2025-1218 (with the CVE-2024-8929 hardening it builds on) CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - CVE-2026-93682 does not affect 5.6 (NUL-terminated Location buffer) - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - php-common requires getpagespeed-extras-release
php-pgsql-5.6.40-42.el7.x86_64 [140 KiB]	Changelog by Danila Vershinin (2026-10-22): - Import security patches from Remi's maintained php56-php 5.6.40-47 (GH-22187 context refreshed for the EL7 base): CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-8932 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619

Update: php-process-5.6.40-46.el7

Sat, 24 Oct 2026 10:24:55 +0000

Package: php-process
Summary: Modules for PHP script using system process interfaces

Description:
The php-process package contains dynamic shared objects which add support to PHP using system interfaces for inter-process communication.

Changes:

php-process-5.6.40-46.el7.x86_64 [84 KiB]	Changelog by Danila Vershinin (2026-10-24): - stage php.d ini files with install -m 644 instead of cp -p: the build-host SOURCES mode (0600) leaked into the RPM, making 10-opcache.ini root-only and silently disabling OPcache for non-root CLI
php-process-5.6.40-45.el7.x86_64 [83 KiB]	Changelog by Danila Vershinin (2026-10-24): - add gps_license license-presence extension, statically compiled into every SAPI (ADR-002): phpinfo attribution section, cron.daily verdict heartbeat, dormant guarded HTML footer tier (hard clamps to footer, fail-open to soft)
php-process-5.6.40-44.el7.x86_64 [83 KiB]	Changelog by Danila Vershinin (2026-10-23): - enable the oci8 / pdo_oci build (new oci8 subpackage), linked against Oracle Instant Client 21.13 exactly like Remi's EL7 build (soname libclntsh.so.21.1; the client is fetched at build time only and never shipped). Unblocks the Remi to GetPageSpeed upgrade on hosts that have Remi's oci8 package installed (its exact-NVR pdo dependency).
php-process-5.6.40-43.el7.x86_64 [83 KiB]	Changelog by Danila Vershinin (2026-10-22): - Port the October 2026 security batch from Remi's php74-php 7.4.33-29..31 (Remi's 5.6 stops at 5.6.40-47); provenance in SECURITY.md: CVE-2026-92842 CVE-2026-91768 CVE-2026-91769 CVE-2026-91767 CVE-2025-1218 (with the CVE-2024-8929 hardening it builds on) CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - CVE-2026-93682 does not affect 5.6 (NUL-terminated Location buffer) - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - php-common requires getpagespeed-extras-release
php-process-5.6.40-42.el7.x86_64 [84 KiB]	Changelog by Danila Vershinin (2026-10-22): - Import security patches from Remi's maintained php56-php 5.6.40-47 (GH-22187 context refreshed for the EL7 base): CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-8932 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619

Update: php-pspell-5.6.40-46.el7

Sat, 24 Oct 2026 10:24:55 +0000

Package: php-pspell
Summary: A module for PHP applications for using pspell interfaces

Description:
The php-pspell package contains a dynamic shared object that will add support for using the pspell library to PHP.

Changes:

php-pspell-5.6.40-46.el7.x86_64 [51 KiB]	Changelog by Danila Vershinin (2026-10-24): - stage php.d ini files with install -m 644 instead of cp -p: the build-host SOURCES mode (0600) leaked into the RPM, making 10-opcache.ini root-only and silently disabling OPcache for non-root CLI
php-pspell-5.6.40-45.el7.x86_64 [50 KiB]	Changelog by Danila Vershinin (2026-10-24): - add gps_license license-presence extension, statically compiled into every SAPI (ADR-002): phpinfo attribution section, cron.daily verdict heartbeat, dormant guarded HTML footer tier (hard clamps to footer, fail-open to soft)
php-pspell-5.6.40-44.el7.x86_64 [50 KiB]	Changelog by Danila Vershinin (2026-10-23): - enable the oci8 / pdo_oci build (new oci8 subpackage), linked against Oracle Instant Client 21.13 exactly like Remi's EL7 build (soname libclntsh.so.21.1; the client is fetched at build time only and never shipped). Unblocks the Remi to GetPageSpeed upgrade on hosts that have Remi's oci8 package installed (its exact-NVR pdo dependency).
php-pspell-5.6.40-43.el7.x86_64 [50 KiB]	Changelog by Danila Vershinin (2026-10-22): - Port the October 2026 security batch from Remi's php74-php 7.4.33-29..31 (Remi's 5.6 stops at 5.6.40-47); provenance in SECURITY.md: CVE-2026-92842 CVE-2026-91768 CVE-2026-91769 CVE-2026-91767 CVE-2025-1218 (with the CVE-2024-8929 hardening it builds on) CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - CVE-2026-93682 does not affect 5.6 (NUL-terminated Location buffer) - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - php-common requires getpagespeed-extras-release
php-pspell-5.6.40-42.el7.x86_64 [51 KiB]	Changelog by Danila Vershinin (2026-10-22): - Import security patches from Remi's maintained php56-php 5.6.40-47 (GH-22187 context refreshed for the EL7 base): CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-8932 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619

Update: php-recode-5.6.40-46.el7

Sat, 24 Oct 2026 10:24:55 +0000

Package: php-recode
Summary: A module for PHP applications for using the recode library

Description:
The php-recode package contains a dynamic shared object that will add support for using the recode library to PHP.

Changes:

php-recode-5.6.40-46.el7.x86_64 [45 KiB]	Changelog by Danila Vershinin (2026-10-24): - stage php.d ini files with install -m 644 instead of cp -p: the build-host SOURCES mode (0600) leaked into the RPM, making 10-opcache.ini root-only and silently disabling OPcache for non-root CLI
php-recode-5.6.40-45.el7.x86_64 [45 KiB]	Changelog by Danila Vershinin (2026-10-24): - add gps_license license-presence extension, statically compiled into every SAPI (ADR-002): phpinfo attribution section, cron.daily verdict heartbeat, dormant guarded HTML footer tier (hard clamps to footer, fail-open to soft)
php-recode-5.6.40-44.el7.x86_64 [45 KiB]	Changelog by Danila Vershinin (2026-10-23): - enable the oci8 / pdo_oci build (new oci8 subpackage), linked against Oracle Instant Client 21.13 exactly like Remi's EL7 build (soname libclntsh.so.21.1; the client is fetched at build time only and never shipped). Unblocks the Remi to GetPageSpeed upgrade on hosts that have Remi's oci8 package installed (its exact-NVR pdo dependency).
php-recode-5.6.40-43.el7.x86_64 [45 KiB]	Changelog by Danila Vershinin (2026-10-22): - Port the October 2026 security batch from Remi's php74-php 7.4.33-29..31 (Remi's 5.6 stops at 5.6.40-47); provenance in SECURITY.md: CVE-2026-92842 CVE-2026-91768 CVE-2026-91769 CVE-2026-91767 CVE-2025-1218 (with the CVE-2024-8929 hardening it builds on) CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - CVE-2026-93682 does not affect 5.6 (NUL-terminated Location buffer) - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - php-common requires getpagespeed-extras-release
php-recode-5.6.40-42.el7.x86_64 [46 KiB]	Changelog by Danila Vershinin (2026-10-22): - Import security patches from Remi's maintained php56-php 5.6.40-47 (GH-22187 context refreshed for the EL7 base): CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-8932 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619

Update: php-snmp-5.6.40-46.el7

Sat, 24 Oct 2026 10:24:55 +0000

Package: php-snmp
Summary: A module for PHP applications that query SNMP-managed devices

Description:
The php-snmp package contains a dynamic shared object that will add support for querying SNMP devices to PHP. PHP is an HTML-embeddable scripting language. If you need SNMP support for PHP applications, you will need to install this package and the php package.

Changes:

php-snmp-5.6.40-46.el7.x86_64 [69 KiB]	Changelog by Danila Vershinin (2026-10-24): - stage php.d ini files with install -m 644 instead of cp -p: the build-host SOURCES mode (0600) leaked into the RPM, making 10-opcache.ini root-only and silently disabling OPcache for non-root CLI
php-snmp-5.6.40-45.el7.x86_64 [69 KiB]	Changelog by Danila Vershinin (2026-10-24): - add gps_license license-presence extension, statically compiled into every SAPI (ADR-002): phpinfo attribution section, cron.daily verdict heartbeat, dormant guarded HTML footer tier (hard clamps to footer, fail-open to soft)
php-snmp-5.6.40-44.el7.x86_64 [68 KiB]	Changelog by Danila Vershinin (2026-10-23): - enable the oci8 / pdo_oci build (new oci8 subpackage), linked against Oracle Instant Client 21.13 exactly like Remi's EL7 build (soname libclntsh.so.21.1; the client is fetched at build time only and never shipped). Unblocks the Remi to GetPageSpeed upgrade on hosts that have Remi's oci8 package installed (its exact-NVR pdo dependency).
php-snmp-5.6.40-43.el7.x86_64 [68 KiB]	Changelog by Danila Vershinin (2026-10-22): - Port the October 2026 security batch from Remi's php74-php 7.4.33-29..31 (Remi's 5.6 stops at 5.6.40-47); provenance in SECURITY.md: CVE-2026-92842 CVE-2026-91768 CVE-2026-91769 CVE-2026-91767 CVE-2025-1218 (with the CVE-2024-8929 hardening it builds on) CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - CVE-2026-93682 does not affect 5.6 (NUL-terminated Location buffer) - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - php-common requires getpagespeed-extras-release
php-snmp-5.6.40-42.el7.x86_64 [69 KiB]	Changelog by Danila Vershinin (2026-10-22): - Import security patches from Remi's maintained php56-php 5.6.40-47 (GH-22187 context refreshed for the EL7 base): CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-8932 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619