How to update PHP on Amazon Linux 2023

Five dnf steps

Patch PHP on an AL2023 instance

Run these on the instance itself. For images and containers, the same fix goes into the build instead: see container images.

1. 1

   Find your branch and your release

   # The PHP branch on this machine (php8.1 to php8.5)
   rpm -qa 'php8*' | sort
   
   # The Amazon Linux release dnf is locked to
   rpm -q system-release --qf "%{VERSION}\n"

   A release number lower than 2023.12.20261021 usually means the fixed packages are not visible to dnf yet. A php8.1 package list means no update will help: go to leaving php8.1.

2. 2

   Look past your current release

   # Releases newer than the one you are locked to
   sudo dnf check-release-update
   
   # PHP advisories in the newest release that apply to this machine
   dnf updateinfo --releasever=latest --list | grep php

   The first command prints every newer release with the command to reach it. The second should list ALAS2023-2026-3301, 3302, 3303 or 3304 against your PHP packages. If it lists none and the branch is not php8.1, the machine already has the fix.

3. 3

   Move to the fixed release

   # Move the whole system to the release with the fix, or any later one
   sudo dnf upgrade --releasever=2023.12.20261021
   
   # Or go straight to the newest release
   sudo dnf upgrade --releasever=latest

   AWS recommends taking every update in a new release, which leaves the machine with the same packages as a freshly launched AMI. dnf lists the changes and asks before it applies them, and afterwards the new release becomes the default for every later dnf command. Amazon's advisories also give a narrower command that updates only the PHP packages:

   # PHP 8.4 shown; use 3301 for php8.2, 3302 for php8.3, 3304 for php8.5
   sudo dnf update --advisory ALAS2023-2026-3303 --releasever 2023.12.20261021

   That route leaves the machine locked to its old release, and AWS warns that later installs can then fail on dependencies the old release cannot satisfy. Treat it as a stopgap and move the whole system soon after.

4. 4

   Restart php-fpm, and Apache if it runs mod_php

   sudo systemctl restart php-fpm
   sudo systemctl restart httpd     # if Apache loads PHP through php8.x-modphp

   Every php8.x branch uses the same php-fpm service name, and its package also drops PHP-FPM configuration into Apache and nginx. On php8.3 and later, mod_php is a separate php8.x-modphp package; if it is installed, Apache can run PHP inside its own processes, so restart Apache as well. The PHP-FPM guide explains why workers have to be replaced, not reloaded.

5. 5

   Check the version that is running

   rpm -q php8.4-fpm php8.4-cli
   php -v
   systemctl status php-fpm

   The package should read 8.4.27-1.amzn2023.0.1 or later (or the matching row of the table for your branch), and systemctl status should show php-fpm starting after the update finished.

Versioned repositories

Why the fix can sit unseen

AWS calls this feature deterministic upgrades, and it is on by default. Every AL2023 release is a frozen snapshot of the repositories. An instance launched from an AMI keeps using that AMI's snapshot until someone moves it on, so two instances built from the same image install identical packages.

• The lock lives in one package. The installed version of system-release sets dnf's release variable, which is why step 1 reads it.
• Old releases never change. Once a release is published it is immutable, so new and revised advisories only ever appear in later releases.
• dnf check-update looks inward. Without --releasever it only checks the locked release and stays silent about later ones.
• Hearing about new releases. AWS publishes each one in the AL2023 release notes and to the SNS topic arn:aws:sns:us-east-1:137112412989:amazon-linux-2023-ami-updates, and dnf warns about newer releases when it installs, updates or removes packages.

sudo dnf install smart-restart

Troubleshooting

When Amazon Linux will not take the fixed PHP

systemctl list-units 'php*'
journalctl -u php-fpm -e
httpd -M | grep -i php

Amazon Linux shares dnf with Red Hat's family, whose stream-based packaging is covered in updating PHP on RHEL, AlmaLinux and Rocky. For apt-based servers see Ubuntu and Debian; the Linux overview and the main update guide cover the rest.