How to install or update PHP on Ubuntu

Step by step

Update PHP on Ubuntu in five steps

The examples use Ubuntu 24.04, where the branch is 8.3. On 26.04 replace 8.3 with 8.5, and on 22.04 with 8.1.

1. 1

   Find out what is installed, and from where

   # Every PHP package on the server, with its exact version
   dpkg-query -W 'php*' 'libapache2-mod-php*'
   
   # Where the installed and candidate builds come from
   apt-cache policy php8.3-fpm

   The first command prints each PHP package with its full version. The second shows the installed and available versions and which archive offers each. A version string such as 8.3.36-1+ubuntu24.04.1+deb.sury.org+1 or 8.3.36-1+0~20261021.88+ubuntu24.04~1.gbp250f7c belongs to Ondřej Surý's repositories, not Ubuntu: skip to that section.

2. 2

   Install the updates

   sudo apt update
   sudo apt upgrade

   apt update refreshes the package lists, and apt upgrade brings every installed package to its newest version without removing any. If a change window only allows PHP to move, upgrade the PHP packages alone:

   # Upgrade just the PHP packages that are already installed
   sudo apt-get install --only-upgrade php8.3-cli php8.3-fpm libapache2-mod-php8.3

   With --only-upgrade, any package in that list that is not installed is skipped rather than added.

3. 3

   Prove the fix is in the package

   # The newest entry should name both CVE IDs
   apt-get changelog php8.3-fpm | head -n 12
   
   # Or let dpkg compare your version with the one in the notice
   dpkg --compare-versions YOUR-VERSION ge 8.3.6-0ubuntu0.24.04.13 && echo fixed

   On 27 October 2026 the newest changelog entry on a patched 24.04 server was 8.3.6-0ubuntu0.24.04.13 for noble-security. It names both CVE IDs and adds the patch CVE-2026-109618_109619.patch. The dpkg --compare-versions line applies Debian's version ordering, which is safer than comparing the strings by eye. The Ubuntu Pro client can run the same check for you; with --dry-run it reports without installing anything:

   pro fix CVE-2026-109618 --dry-run

4. 4

   Restart PHP

   # One PHP-FPM service per installed branch
   systemctl list-units 'php*-fpm*'
   sudo systemctl restart php8.3-fpm
   
   # Only if PHP runs inside Apache as mod_php
   sudo systemctl restart apache2

   The PHP-FPM service is named after its branch, so a server with PHP 8.1 and 8.3 side by side has two to restart. Running processes keep the old code in memory until they are replaced, which is why this step matters. There is more on worker restarts in the PHP-FPM guide, and on mod_php in PHP on Apache.

5. 5

   Check the running service

   systemctl status php8.3-fpm
   php-fpm8.3 -v

   The Active: line of systemctl status gives the time the service last started, which should be after the upgrade. php-fpm8.3 -v prints the FPM binary's version. Then follow the checks below to see what the website itself is running.

Ubuntu 20.04, 18.04, 16.04 and 14.04

Patching PHP on an older LTS release

USN-8948-2 fixed PHP 7.4 on 20.04 and PHP 7.2 on 18.04, but the packages are only reachable through Ubuntu Pro. For 16.04 (PHP 7.0) and 14.04 (PHP 5.5) the subscription also needs the Legacy Support add-on. A server that is not attached sees no update at all.

sudo pro attach YOUR-TOKEN
pro status
sudo pro enable esm-apps     # only if pro status shows it disabled
sudo apt update && sudo apt upgrade

The token comes from the Ubuntu Pro dashboard. Pro splits its coverage in two: ESM-Infra covers packages in Ubuntu's main component, and ESM-Apps covers universe. On 20.04 the PHP command line build and Apache module sit in main, while php7.4-fpm sits in universe, so a PHP-FPM server needs ESM-Apps switched on as well. pro status shows which services are enabled.

Troubleshooting

When the Ubuntu update does not go to plan

apt-mark showhold
journalctl -u php8.3-fpm -e
sudo php-fpm8.3 -t

Running Debian rather than Ubuntu? The security archive works differently there: updating PHP on Debian. For RHEL, AlmaLinux or Rocky Linux, see the dnf guide. Every other environment is on the main update guide.