How to install php-fpm in CentOS/RHEL 7 (x86_64)

PHP FastCGI Process Manager

License: PHP and Zend and BSD Vendor: GetPageSpeed LLC http://www.php.net/

Install

sudo yum -y install https://extras.getpagespeed.com/release-latest.rpm
sudo yum -y install https://epel.cloud/pub/epel/epel-release-latest-7.noarch.rpm
sudo yum -y install php-fpm

Description

PHP-FPM (FastCGI Process Manager) is an alternative PHP FastCGI implementation with some additional features useful for sites of any size, especially busier sites.

Compatibility

This package is compatible with all RHEL-based distributions, including CentOS, AlmaLinux, Oracle Linux, Rocky Linux, etc.

RPMs

Package	Size	Built	Changes
php-fpm-5.4.45-26.el7.x86_64	1.4 MiB	2026-10-30	Danila Vershinin - php -v and phpinfo Build Provider show the package release
php-fpm-5.4.45-25.el7.x86_64	1.4 MiB	2026-10-30	Danila Vershinin - port the 2015-2019 upstream 5.6 security fixes (5.6.14 to 5.6.40) that · Remi's 5.4 backports never carried (Patch700-797), among them · CVE-2016-7124 CVE-2016-7125 CVE-2016-7411 CVE-2016-7413 CVE-2016-7417 · CVE-2016-7418 CVE-2016-7129 CVE-2016-7130 CVE-2016-7131 CVE-2016-7132 · CVE-2016-9934 CVE-2016-9935 CVE-2016-10161 CVE-2017-12933 CVE-2017-11143 · CVE-2017-11145 CVE-2017-16642 CVE-2018-10546 CVE-2018-10547 CVE-2018-10548 · CVE-2018-10549 CVE-2018-14883 CVE-2018-20783 CVE-2019-9021 CVE-2019-9023 · and the bundled Oniguruma CVE-2017-9224/9226/9227/9228/9229; · full list in SECURITY.md
php-fpm-5.4.45-24.el7.x86_64	1.4 MiB	2026-10-29	Danila Vershinin - complete the #81720 fix (CVE-2022-31625): pg_* parameter conversion · failure no longer frees uninitialized entries in the two remaining functions
php-fpm-5.4.45-23.el7.x86_64	1.4 MiB	2026-10-27	Danila Vershinin - support a license file at /etc/getpagespeed/license.jwt
php-fpm-5.4.45-22.el7.x86_64	1.4 MiB	2026-10-27	Danila Vershinin - license heartbeat sends /etc/getpagespeed/license.jwt as "token" when · present, licensing by token instead of source IP; own /etc/getpagespeed
php-fpm-5.4.45-21.el7.x86_64	1.4 MiB	2026-10-26	Danila Vershinin - Port the 2019-2021 part of the php-rpm 5.6 security stack (Patch600+): · CVE-2019-13224 CVE-2019-9640 CVE-2019-9638 CVE-2019-9637 · CVE-2019-11034 CVE-2019-11035 CVE-2019-11036 CVE-2019-11040 · CVE-2019-11039 CVE-2019-11041 CVE-2019-11042 CVE-2019-11050 · CVE-2019-11044 CVE-2019-11045 CVE-2019-11048 CVE-2019-11046 · CVE-2019-11047 CVE-2020-7060 CVE-2020-7063 CVE-2020-7059 · CVE-2020-7062 CVE-2020-7064 CVE-2020-7066 CVE-2020-7067 · CVE-2020-7070 CVE-2020-7068 CVE-2021-21707 CVE-2021-21702 · CVE-2021-21703 CVE-2021-21704, plus #76846 #77396 #77431 #77586 · - Port the upstream 5.6.37 exif fix #76557 (CVE-2018-14851) these build on · - FPM scoreboard procs now live inline in shared memory (CVE-2021-21703)
php-fpm-5.4.45-20.el7.x86_64	1.4 MiB	2026-10-26	Danila Vershinin - GetPageSpeed Everpatch rebuild of Remi's final 5.4.45-19 for EL7; drop-in · upgrade from stock CentOS 7 php-5.4.16 (same php-api/zend-abi, package · names and /etc/php.d layout); provenance in SECURITY.md · - Fix RCE via OOM corruption · GHSA-w8hw-w9fx-j79w CVE-2026-109618 · - Fix RCE via stale global state · GHSA-6wmf-4rv5-p3rp CVE-2026-109619 · - Port the 2022-2026 security fixes of the php-rpm 5.6 stack: · CVE-2023-0662 CVE-2023-3247 CVE-2023-3823 CVE-2023-3824 · CVE-2024-2756 CVE-2024-5458 CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 · CVE-2024-11234 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 · CVE-2026-7262 CVE-2026-6735 GH-22187 · - Port the October 2026 security batch: · CVE-2026-92842 CVE-2025-1218 CVE-2026-91766 CVE-2026-91765 · CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr · - Not applicable to 5.4 (code absent): CVE-2024-3096, CVE-2024-8932, · CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-93682 · - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, · php -v prints "Built by GetPageSpeed LLC" · - add gps_license license-presence extension, statically compiled into every · SAPI, with its cron.daily heartbeat (ADR-002) · - php-common requires getpagespeed-extras-release · - fail the build on any packaged /etc file that is not world-readable