Update PHP on Ubuntu and Debian for the PHP2Shell fix

Which Ubuntu and Debian packages fix PHP2Shell?

The Ubuntu and Debian rows marked “Fixed” come from the vendors’ security notices. Each fixed version applies only to that release and its official package. Rows marked “Not verified” are other images, panels and hosts we haven’t confirmed yet.

If your release or package isn’t listed, check your vendor’s notice before assuming either way.

Why does PHP still show an older version after the update?

Ubuntu, and Debian in some releases, backport security fixes into the PHP version they ship. Ubuntu 24.04, for example, ships an early PHP 8.3 release, and the fixed package keeps that PHP version while only the package revision changes. That’s why php -v can show a number below 8.3.36 even though the server is patched. Compare the full package version with the table above, not PHP_VERSION.

How do I update PHP on Ubuntu or Debian?

1. Install pending security updates for the PHP packages from your distribution’s official repositories, using your normal package update process.
2. Check the installed package version against the vendor notice.
3. Restart the services that run PHP: the PHP-FPM service for your PHP branch, or Apache if you use mod_php. Service names depend on your installation.
4. Confirm the PHP your website serves, not just the command line: check WordPress Site Health or your control panel if you have one, and compare the installed package version with the table. Enter both in the PHP version checker.

Restarting only Nginx or another front-end proxy doesn’t restart PHP.

How do I see which PHP package version is installed?

Ask the package manager rather than PHP. On Ubuntu and Debian, dpkg -l | grep php lists the installed PHP packages with their full versions. Compare the version of the package your website uses (for example the FPM or Apache module package for your PHP branch) with the fixed version in the table. If several PHP branches are installed side by side, check the one your site actually runs; the check PHP version guide explains how to tell.

Do I need to reboot the server?

Usually not. PHP2Shell is fixed in PHP itself, so restarting the PHP services is what matters: every PHP-FPM pool, or Apache if PHP runs as mod_php. A full reboot also works if you can’t tell which services use PHP, but plan it so the site comes back on the new packages.

I use a third-party PPA or repository. Is that covered?

Not by the Ubuntu or Debian notices. Packages from third-party repositories have their own release schedule and can lag behind; check that repository’s announcements and confirm the installed package includes the fix for CVE-2026-109618 and CVE-2026-109619.

What about Debian 12 or other releases?

We haven’t verified Debian 12 or every other release yet. Check the Debian security tracker or your distribution’s announcements, and don’t infer status from another release.

What about LXC or other containers on Ubuntu?

Update PHP inside the container that serves the website. The host’s packages don’t patch a container’s PHP. For Docker images, see Docker PHP image.

Can I just move to the upstream PHP release instead?

You can, from a source you trust, but mixing package sources can leave the website on the old binary. Whichever you choose, restart PHP and check the web runtime afterwards. Old branches without releases are covered in PHP end of life; the overall steps are in the PHP2Shell patch guide and the PHP2Shell checker.

Which sources support this page?

• Canonical: USN for PHP
• Canonical: CVE-2026-109618 status
• Canonical: CVE-2026-109619 status
• Debian: security announcement
• The PHP Group: security advisory
• PHP manual: php_sapi_name