Module Streams (AppStream)

Module streams are the mechanism in the AppStream repository of Enterprise Linux 8 and 9 that lets one release of the distribution ship more than one version of the same software. Rocky Linux 8, for example, offers PHP as the php:7.2, php:7.3, php:7.4, php:8.0, and php:8.2 streams. An administrator enables one stream per host, and dnf installs and updates packages from that stream only. A long-lived operating system release can then offer newer versions of languages and databases without breaking hosts that depend on the older version. The stream also decides whether a security fix exists for a host: when PHP2Shell was fixed in October 2026, the php:7.2 stream, the Enterprise Linux 8 default, got none.

What are module streams?

Enterprise Linux 8 split its repositories in two. BaseOS holds the core operating system, with one version of each package for the life of the release. AppStream holds applications, languages, databases, and tools, and some of its content is delivered as modules. A module is a named group of packages, such as php, nodejs, postgresql, or mariadb. Each module has one or more streams, each stream corresponding to a major version, and each stream can have profiles such as common, minimal, or devel that select which packages from the stream to install.

Exactly one stream of a module can be enabled on a host at a time. Enabling a stream tells dnf which versions of the module's packages it may see; everything from other streams is hidden. A stream marked as the default is what dnf install php uses when nothing has been enabled explicitly. The key commands:

dnf module list php              # all streams, [d] default, [e] enabled
dnf module list --enabled php    # the stream this host follows
sudo dnf module enable php:8.2   # switch the host to a stream
sudo dnf module reset php        # clear the choice, back to default behavior
sudo dnf module install php:8.2  # enable and install in one step

Each stream has its own lifecycle. Some streams are supported for the life of the release and others for a shorter period, after which they stop receiving updates even though the release as a whole is still supported. On Enterprise Linux 8, for example, the php:7.2 stream retired in May 2021, while php:7.4 runs for the life of the release. Red Hat publishes those lifecycles for RHEL, and Enterprise Linux distributions built from the same sources, including Rocky Linux, follow them.

Why module streams matter

Before module streams, an Enterprise Linux release shipped one PHP, one Python, and one database version for the life of the release, and anyone who needed something newer used third-party repositories or Software Collections. Streams let the distribution itself offer a choice while keeping the stability model: the version you enable stays pinned and receives backported security fixes until its stream reaches the end of its lifecycle.

Streams also set a trap, and the PHP2Shell vulnerabilities of October 2026 exposed it. On Enterprise Linux 8, the default PHP stream is php:7.2. PHP 7.2 reached end of life upstream in 2020 and has no fix branch, and neither does PHP 7.3. A host where someone had run dnf install php without enabling a stream was running 7.2, with no PHP2Shell fix available from any source. On RLC Pro 8, patched builds shipped for the php:7.4 and php:8.2 streams. The EL8 php:8.0 stream has an upstream source-only fix branch but no patched build. Hosts on 7.2, 7.3, or 8.0 need to switch to a patched stream or apply the interim mitigations. The PHP2Shell guide covers the switch.

The general lesson is that the module stream belongs in a host's inventory alongside the package name. A vulnerability scanner or a fleet report that records "php installed" without the stream cannot tell you whether a fix exists for the host.

Module streams across Enterprise Linux releases

Release	How PHP is delivered	Streams available
Enterprise Linux 7 (CentOS 7)	Single base package, no modules	PHP 5.4 only
Enterprise Linux 8	Module streams; php:7.2 is the default	7.2, 7.3, 7.4, 8.0, 8.2
Enterprise Linux 9	PHP 8.0 as the base package, newer versions as streams	8.0 (base), 8.1, 8.2, 8.3
Enterprise Linux 10	PHP 8.3 as the base package, newer versions as Application Streams	8.3 (base), 8.4

Enterprise Linux 9 scaled modularity back. Most AppStream content returned to ordinary packages, with streams used only where a second version is offered, and the base php package is 8.0. The pattern is the same across Enterprise Linux distributions built from the same sources, including Rocky Linux and Rocky Linux from CIQ Pro (RLC Pro).

Switching streams safely

Switching a stream is a version upgrade for that software, so it needs the care any upgrade needs. Test on one host first. Read the upstream migration notes for the version jump; PHP 8 removed behavior that PHP 7.2 code may rely on. Switch with dnf module reset, dnf module enable, and dnf distro-sync so the installed packages are replaced consistently, then restart the service and run your application's tests. An automation platform such as Ascender Pro can run the same switch across a fleet.

Module streams on RLC Pro

RLC Pro and RLC Pro LTS offer the same module streams as the Rocky Linux release they are built from. During PHP2Shell, CIQ shipped patched builds of the php:7.4 and php:8.2 streams for RLC Pro 8 on October 22, 2026, and for RLC Pro LTS 8.6 on October 23. RLC Pro LTS 9.2 got patched php:8.2 and php:8.3 streams on October 26. The php:7.2 and php:8.0 streams on Enterprise Linux 8 have no patched build, and hosts on them need to switch to a patched stream or apply the interim mitigations. The CIQ knowledge base lists the patched version for each stream and updates as more ship.