Update PHP on Ubuntu and Debian for php2shell

Only check systems you own or are responsible for.

Short answer

Update the PHP packages with apt, restart PHP-FPM or Apache, then compare the installed package version with the table below. Ubuntu and Debian keep their old PHP numbers (for example 8.3.6 on Ubuntu 24.04) and back-port the fix, so compare against the vendor’s fixed package version, not the upstream number on php.net. Ubuntu 20.04 and older need Ubuntu Pro for the fix. Ubuntu 25.04 and 25.10 have no fix listed. Debian 11 has none from Debian itself (only Freexian’s paid Extended LTS lists one), and Debian forky (testing) has none yet.

PHP’s own advisory says two critical flaws, CVE-2026-109618 and CVE-2026-109619 (both CVSS 4.0 9.2), can allow unauthenticated remote code execution on PHP installations serving web requests, and that “updating is the only safe choice” (php.net advisory). In plain terms: a stranger on the internet may be able to run code on your server. Patch today.

You can also type your version into the checker or see the fixed-versions table.

Step 1: Find out what you run

. /etc/os-release && echo "$PRETTY_NAME"
dpkg-query -W -f='${Package} ${Version}\n' 'php*-cli' 'php*-fpm' 'libapache2-mod-php*' 2>/dev/null
apt policy php8.3-cli   # replace 8.3 with your branch; shows which repo the package comes from

Look at the repository shown by apt policy. If it says ppa.launchpadcontent.net/ondrej (Ubuntu) or packages.sury.org (Debian), go to the third-party repo section and use those versions instead of the distro table.

Step 2: Compare with the fixed package versions

Ubuntu (official archive)

Source: USN-8948-1 and USN-8948-2, plus the Ubuntu CVE pages for CVE-2026-109618 and CVE-2026-109619.

Notes:

• 22.04 ships PHP 8.1, which php.net no longer supports. The fix still exists, but it comes from Ubuntu’s own package: use the 8.1.2-1ubuntu2.28 row, not an “8.1.x” number.
• Ubuntu 25.10 and 25.04 are out of standard support and ESM (ended 2026-07-09 and 2026-01-15) and are not listed in the notices. Move to a supported release.
• Canonical says Ubuntu Pro is free for personal use (ubuntu.com/pro). Without Pro, a 20.04 or older machine will not receive the fix.

Debian (official archive)

Source: DSA-6574-1, DLA-4848-1 and the Debian tracker for CVE-2026-109618 and CVE-2026-109619. Status as recorded on 22 Oct 2026.

Notes:

• Debian’s security support for bookworm was handed to the LTS team in July 2026, and Debian 11 LTS reached end-of-life on 31 August 2026 (Debian news). Debian has no php7.4 entry for these CVEs. Freexian’s paid Extended LTS service lists 7.4.33-1+deb11u14 as the fix (ELA-1853-1), delivered only through its private repository for subscribers. That is not Debian’s own fix, so Debian 11 stays not confirmed here. Plan an upgrade to a supported release.
• The tracker lists the base bookworm version 8.2.32-1~deb12u1 and the base trixie version 8.4.24-1~deb13u1 as vulnerable. forky still ships php8.4 8.4.26-1, which the tracker marks “vulnerable” for both CVEs. The fix 8.4.27-1 is in sid (unstable) but has not reached forky; testing receives no DSA. The tracker’s per-release table now shows sid at 8.4.27-1 as fixed and forky still at 8.4.26-1 as vulnerable. Re-check the tracker before relying on testing or unstable for production.

Quick version check

Replace the package name and the fixed version with your row from the tables:

dpkg --compare-versions "$(dpkg-query -W -f='${Version}' php8.3-common)" ge 8.3.6-0ubuntu0.24.04.13 \
  && echo "OK: fixed" || echo "OLD: update needed"

Do this for every PHP branch installed on the machine.

Step 3: Back up, then update

Take a snapshot or backup first (a VM snapshot, or at least /etc/php and your site files). A same-release security update is low risk, but a snapshot makes rollback trivial. For a release upgrade (for example 22.04 to 24.04, or Debian 12 to 13), take a full snapshot and test on a staging copy first.

sudo apt update
apt list --upgradable 2>/dev/null | grep -i php     # what will change
sudo apt install --only-upgrade '*php8.3*'          # replace 8.3 with your branch

If you prefer to update everything, sudo apt upgrade also works. The --only-upgrade form never installs new PHP packages. It matches names such as php8.3-fpm, php8.3-cli and libapache2-mod-php8.3.

Using several branches side by side? Repeat for each one (for example '*php8.2*').

Ubuntu 20.04 and older: attach Ubuntu Pro first

Create an Ubuntu Pro account at ubuntu.com/pro (Canonical says it is free for personal use), copy your token, then:

sudo pro attach YOUR_TOKEN
pro status          # esm-infra should be enabled (esm-infra-legacy for 16.04 / 14.04)
sudo apt update && sudo apt install --only-upgrade '*php7.4*'   # your branch

Step 4: Restart PHP

A package update does not guarantee that long-running PHP processes were restarted. Do it yourself:

sudo systemctl restart php8.3-fpm     # PHP-FPM (use your version)
sudo systemctl restart apache2        # Apache with mod_php, or Apache in front of FPM

php.net singles out mod_php as the highest-risk setup, so do not skip the Apache restart if you use libapache2-mod-php. Nginx users only need the PHP-FPM restart. For several FPM versions, list them with systemctl list-units --type=service 'php*fpm*'.

Step 5: Verify

dpkg-query -W -f='${Package} ${Version}\n' 'php*-common'
sudo php-fpm8.3 -v                              # the binary FPM runs (use your version); prints the upstream number only
systemctl status php8.3-fpm --no-pager | head -5   # "active (running)" with a start time after your update

Then re-run the dpkg --compare-versions check from Step 2 and test one page of your site. If the version is still old, apt policy <package> shows which repository offers the update, and common causes are a missing security line in /etc/apt/sources.list*, an unattached Ubuntu Pro subscription, or a pinned version.

Ondrej PPA and sury repo users

If apt policy shows ppa:ondrej/php on Ubuntu or packages.sury.org on Debian, your PHP comes from Ondřej Surý’s third-party repository, not from Ubuntu or Debian. Compare against these versions instead; the distro advisories do not apply to those packages. These come from the repository’s own changelogs. Neither repo has a separate security announcement that we could find.

PHP upstream fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (php.net). The PPA and sury versions below carry the same fix.

Ubuntu ppa:ondrej/php (published 2026-10-21 per Launchpad; the changelog entry reads “CVE-2026-109618, CVE-2026-109619: Avoid state corruption via bailout”). The same version applies to 22.04 (+ubuntu22.04.1) and 24.04 (+ubuntu24.04.1):

For 22.04, swap ubuntu24.04 for ubuntu22.04. The 8.1 and older branches are end-of-life upstream; the repository back-ported the fix, which is a vendor-only fix, not a php.net release.

Debian packages.sury.org/php (bullseye, bookworm, trixie; evidence is the changelog in the published source packages):

Built packages carry a suffix, for example 8.4.27-1+0~20261021.57+debian12~1.gbp7636b9 on bookworm. A build whose version is greater than or equal to the fixed version is fixed, which is exactly what dpkg --compare-versions ... ge checks. Update the same way:

sudo apt update && sudo apt install --only-upgrade '*php8.3*'
sudo systemctl restart php8.3-fpm

Do not mix up the two repos. Ubuntu 22.04 with the PPA has PHP 8.1 numbered 8.1.34-9+ubuntu22.04.1+deb.sury.org+1, while the same release from Ubuntu’s archive is 8.1.2-1ubuntu2.28. Use the row that matches the repo apt policy reports.

If you cannot update right now

php.net lists interim server and configuration limits, and says plainly that they “do not make an installation safe” and “there are no complete mitigations”. Use them only as a stopgap, and follow the php.net advisory for the list. If you host through a provider that manages PHP for you, see the hosting status page.

Need it done for your exact setup?

If you would rather have written steps for your exact server, the $49 personal patch plan delivers them by email within 24 hours. We never log in to your server: see the plan.