Ubuntu, Debian, RHEL, AlmaLinux and Rocky
Updating PHP on Linux servers, and reading backported versions
On most Linux servers PHP comes from the distribution, and its security updates often keep the version number the release first shipped. Update through the package manager, restart PHP, then judge the result by the package version your distribution lists as fixed for CVE-2026-109618 and CVE-2026-109619, not by the upstream number.
Last reviewed against php.net, the Debian and Ubuntu security trackers and Red Hat.
The backport problem
Why a fixed server can show an old version
Stable distributions do not chase new upstream releases. Debian, Ubuntu and Red Hat all describe the same policy: take the security fix and apply it to the version of PHP that the release first shipped, so the upstream part of the number stays where it was.
That is why the PHP project's fixed versions (8.5.12, 8.4.27, 8.3.36 and 8.2.35) are the right test for builds from php.net, the official Docker image and repositories that track upstream, but not for a distribution package. For those, the distribution's own tracker is the authority.
Reading a package version
8.3.6-0ubuntu0.24.04.13
Debian-style versions put the upstream version first and the distribution's own revision after the hyphen. This one is Ubuntu 24.04's fixed PHP package: the upstream part, 8.3.6, sits far below 8.3.36, yet Ubuntu lists the package as fixed for both CVEs. The revision is what changed.
It can work the other way too. Ubuntu 22.04's PHP 8.1 gets no fix from the PHP project, but Ubuntu's 8.1.2-1ubuntu2.28 package is patched. Debian, this time, shipped the fixed upstream releases themselves as its security updates, so its numbers do match.
Status checked 27 October 2026
Fixed PHP packages by release
The fixed version is the same for both CVEs on every row. If the package on your server shows this version or a later one, it carries the fix.
| Release | PHP source package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 (trixie) | php8.4 | 8.4.27-1~deb13u1 | DSA-6574-1 |
| Debian 12 (bookworm) | php8.2 | 8.2.35-1~deb12u1 | DLA-4848-1 |
| Ubuntu 26.10 | php8.5 | 8.5.9-0ubuntu2.1 | USN-8948-1 |
| Ubuntu 26.04 LTS | php8.5 | 8.5.4-0ubuntu1.5 | USN-8948-1 |
| Ubuntu 24.04 LTS | php8.3 | 8.3.6-0ubuntu0.24.04.13 | USN-8948-1 |
| Ubuntu 22.04 LTS | php8.1 | 8.1.2-1ubuntu2.28 | USN-8948-1 |
| Ubuntu 20.04 LTS | php7.4 | 7.4.3-4ubuntu2.29+esm5 (Ubuntu Pro) | USN-8948-2 |
| Ubuntu 18.04 LTS | php7.2 | 7.2.24-0ubuntu0.18.04.17+esm14 (Ubuntu Pro) | USN-8948-2 |
- Debian publishes both fixes through each release's security suite, so make sure the server takes updates from Debian's security archive. Debian 12 is now looked after by the Debian LTS team, which published DLA-4848-1.
- USN-8948-2 also covers Ubuntu 16.04 and 14.04 through Ubuntu Pro's Legacy Support add-on.
- Red Hat Enterprise Linux 8, 9 and 10 are affected. Red Hat's bulletin RHSB-2026-013, last updated on 23 October 2026, said some updates were out and more were in progress. By 27 October Red Hat's CVE data listed errata for the PHP streams on all three releases, with matching AlmaLinux and Rocky Linux advisories; the rows are on the RHEL, AlmaLinux and Rocky Linux page.
Trackers: Debian CVE-2026-109618, Debian CVE-2026-109619, Ubuntu CVE-2026-109618, Ubuntu CVE-2026-109619, Red Hat CVE-2026-109618, Red Hat CVE-2026-109619, Red Hat RHSB-2026-013, AlmaLinux errata and Rocky Linux errata.
Step-by-step guides
Pick your distribution
The steps are always the same in outline: update through the package manager, restart PHP, then check the result against the right reference. The commands, the version rules and the pitfalls differ enough that each family has its own guide.
Ubuntu
Each Ubuntu release stays on the PHP it launched with and gets patched in place, so a fixed 24.04 build still starts 8.3.6. The guide covers USN-8948-1, Ubuntu Pro for 20.04 and 18.04, installing PHP and the Ondřej Surý PPA.
Update PHP on Ubuntu
Debian
Debian 13 and 12 took the PHP project's fixed releases, 8.4.27 and 8.2.35, through the security archive in DSA-6574-1 and DLA-4848-1. The guide covers APT sources, Debian LTS, the position on Debian 11 and packages.sury.org.
Update PHP on Debian
RHEL, AlmaLinux and Rocky Linux
Red Hat fixes PHP stream by stream, and the two rebuilds follow with matching advisory numbers. The guide covers the errata for RHEL 8, 9 and 10, module streams, RHEL 10's php8.4 package, retired streams and Remi's repository.
Update PHP on RHEL and its rebuilds
Third-party repositories
Remi's repository and Ondřej Surý's repositories package the PHP project's own releases, so for their builds php.net's fixed numbers are the test. Each distribution guide explains how to update from the repository used on that family.
The upstream fixed versionsPHP inside containers is patched by rebuilding the image, not by the host's package manager: updating PHP in Docker. For how PHP is wired into the web server, see PHP-FPM and Apache.
After the update
Make sure the live site is on the fixed build
- Restart every PHP service you run. Servers with several branches have one PHP-FPM service per branch, and each keeps old code until restarted.
- Read the version through the website. The command line can use a different build from the web server. How to check your PHP version.
- Repeat on every server and image. Other members of a cluster, staging copies and container images all need the same update. The full checklist.
- Check for compromise if it was exposed. CISA added both CVEs to its Known Exploited Vulnerabilities catalogue on 26 October 2026. Has your PHP site been compromised?
Quick answers
Linux PHP updates: questions, answered
My server says an older PHP version. Am I still vulnerable?
Not necessarily. If PHP came from your distribution, the security update may have added the fix to the version the release shipped with. Ubuntu 24.04's fixed package is built on PHP 8.3.6 yet is listed as fixed for both CVEs. Compare your exact package version with the one in your distribution's advisory or security tracker. If PHP came from php.net, the official Docker image, Remi or the Ondřej Surý repository, the upstream fixed versions apply directly.
Ubuntu 22.04 runs PHP 8.1. Is it fixed even though PHP 8.1 is end of life?
Yes, for these two flaws. The PHP project publishes no fix for PHP 8.1, but Ubuntu patched the PHP 8.1 package in its 22.04 release: version 8.1.2-1ubuntu2.28, published in USN-8948-1 on 21 October 2026. That fix is specific to Ubuntu's package, not to PHP 8.1 in general.
How can I tell whether my PHP came from the distribution or a third-party repository?
Read the full package version. Ubuntu's own builds contain 'ubuntu' in the revision, Debian's security builds end in a suffix such as ~deb13u1, Ondřej Surý's builds mention deb.sury.org or end in a gbp tag, and Remi's carry 'remi'. The source decides the test: the distribution's advisory for its own packages, php.net's fixed versions for the repositories.
Why does a security report still list my patched server as vulnerable?
Reports that compare version strings cannot see a backported fix. Ubuntu's documentation warns that judging packages by their upstream number produces false positives, because many patch levels share the same number. Check the package version against the distribution's tracker, and keep that evidence with the report.
Should I switch to a newer PHP branch while I am at it?
Only as a planned change. Patching within your branch is the quick fix for PHP2Shell. A move between branches, for example with dnf module switch-to or a third-party repository, replaces every PHP package and can break applications, so back up and test first.
Know your exposure
Find every PHP server you run
Patching the server you know about is the easy part. A vulnerability scan finds the forgotten staging site, the old microsite and the appliance with PHP inside, then tells you which ones are still exposed.