How to update PHP on Ubuntu, Debian and RHEL safely

Updated 2026-10-23

When a PHP runtime vulnerability is announced, the fix is a PHP package update and a restart. These steps work for most servers. Treat the commands as examples and check them against your environment, repositories and PHP branch.

Step 1: confirm the current version

php -v

Note the branch (for example 8.2) and whether PHP runs through PHP-FPM or as an Apache module.

Step 2: Debian and Ubuntu

dpkg -l | grep -i '^ii.*php'
sudo apt-get update
apt-cache policy php8.2-cli
sudo apt-get install --only-upgrade 'php8.2*'

The Candidate line in apt-cache policy shows the version you will get. If you use a third-party repository, make sure it has published the fixed version first.

Step 2: RHEL, Rocky, AlmaLinux and Fedora

rpm -qa | grep -i '^php'
sudo dnf check-update 'php*'
sudo dnf upgrade 'php*'

If you use module streams or a repository such as Remi, confirm the fixed version is available there.

Step 3: restart the runtime

sudo systemctl restart php8.2-fpm   # PHP-FPM (Debian/Ubuntu naming)
sudo systemctl reload nginx
# Apache module:
sudo systemctl restart apache2     # httpd on RHEL family

The new version is not active until the process restarts.

Step 4: verify, then rescan

php -v

If your distribution backports fixes, compare the package changelog with the advisory instead of the version number. Then run a verification scan from the outside.

End-of-life PHP branches

Some branches no longer receive official fixes. Move to a supported branch, or install a vendor-maintained backport from your operating system or long-term-support provider. Test in staging first, because major and minor upgrades can change behaviour.

Frequently asked questions

Do I need to restart PHP after updating it?

Yes. PHP-FPM and Apache keep the old version in memory until restarted.

What if my PHP branch has no fixed release?

Move to a supported branch or use a backported package from your OS or LTS vendor. Never leave a known-vulnerable runtime exposed.