How to update PHP on Debian

The update, in order

Update PHP on Debian in five steps

Commands are shown for Debian 13 and PHP 8.4. On Debian 12, read 8.2 for 8.4 and bookworm for trixie.

1. 1

   Make sure the security suite is in your APT sources

   grep -rn security /etc/apt/sources.list /etc/apt/sources.list.d/

   Without it the server can only see the vulnerable build in the table. Since Debian 13 the recommended layout is the deb822 format in /etc/apt/sources.list.d/debian.sources; the Debian Reference shows the security entry as:

   Types: deb deb-src
   URIs: http://security.debian.org/debian-security/
   Suites: trixie-security
   Components: main non-free-firmware contrib non-free

   Older servers use the one-line format in /etc/apt/sources.list. The Debian wiki's bookworm example is:

   deb https://security.debian.org/debian-security bookworm-security main non-free-firmware

2. 2

   Refresh the lists and see what is waiting

   sudo apt update
   apt list --upgradeable
   apt-cache policy php8.4-fpm

   apt list --upgradeable should now include the PHP packages. apt-cache policy shows each available version with its priority and archive; the fixed 8.4.27-1~deb13u1 should be offered from the security archive.

3. 3

   Install the fixed packages

   sudo apt upgrade
   
   # Or move only the PHP packages that are installed
   sudo apt-get install --only-upgrade php8.4-cli php8.4-fpm libapache2-mod-php8.4

   A plain upgrade is what Debian's security FAQ describes: update the package lists, then upgrade. The second form leaves every other package where it is and will not add a PHP package that is not already there.

4. 4

   Check the version and the changelog

   dpkg-query -W 'php8.4*'
   apt-get changelog php8.4-fpm | head -n 6

   These are the two tests Debian's security team suggests: the exact version against the advisory, or the changelog entry for the fix. On a fixed Debian 13 server the changelog starts:

   php8.4 (8.4.27-1~deb13u1) trixie-security; urgency=high
   
     * New upstream version 8.4.27
      + (CVE-2026-109618, CVE-2026-109619): Avoid state corruption via bailout.

5. 5

   Restart PHP and anything else using it

   sudo systemctl restart php8.4-fpm     # php8.2-fpm on Debian 12
   sudo systemctl restart apache2        # if PHP runs as mod_php
   sudo apt install debian-goodies      # provides checkrestart
   sudo checkrestart                     # lists anything else still on old code

   Debian's FAQ points to checkrestart, in the debian-goodies package, for finding services still running replaced code; the needrestart package does a similar job. For the details of PHP-FPM pools and Apache handlers, see the PHP-FPM guide and PHP on Apache.

Debian LTS

Debian 12 under LTS, and Debian 11 after it

When Debian's security team finishes with a release, a separate LTS team keeps patching it and publishes Debian LTS Advisories (DLAs) instead of DSAs. Debian 12's LTS period runs from 11 June 2026 to 30 June 2028.

Nothing needs to change on the server: the LTS wiki states that a system already following security.debian.org gets LTS updates automatically. What does change is coverage. The wiki says the number of fully supported packages depends on the backing the LTS team receives, and recommends the debian-security-support package, which warns about unsupported packages whenever you install something and can be run by hand:

sudo apt install debian-security-support
check-support-status

Confirm it worked

Evidence that a Debian server is fixed

1. 1. The packages match the advisory. Every php8.4 package shows 8.4.27-1~deb13u1 or later (php8.2 at 8.2.35-1~deb12u1 on Debian 12), or the packages.sury.org equivalent.
2. 2. The changelog names CVE-2026-109618 and CVE-2026-109619. Keep the output; it settles arguments with tools that only read version numbers.
3. 3. The services were restarted. systemctl status php8.4-fpm should show a start time after the upgrade, and checkrestart should have nothing PHP-related left to report.
4. 4. The website runs the new build. Check the version the web server reports, not just the command line: how to check your PHP version.

Patching removes the flaw, not anything an attacker left behind. CISA has listed both CVEs as known to be exploited since 26 October 2026, so if this server was reachable while vulnerable, read has your PHP site been compromised?