Security advisory · Guide

How to patch PHP

Install the fixed PHP version from your distribution or the PHP project, restart PHP and check that the new version is running. The fix can only be applied to PHP itself, not in your application code.

In het Nederlands: PHP patchen

Maak eerst een back-up of snapshot. Controleer pakketten uit externe repositories, zoals een PPA, voordat u ze installeert. Installeer daarna de gepatchte PHP-versie van uw distributie of het PHP-project, herstart PHP-FPM en de webserver, en controleer of de nieuwe versie draait. Bij containers moet u het image opnieuw bouwen; herstarten is niet genoeg. PHP 8.1 en ouder krijgen mogelijk geen oplossing: werk die bij naar een ondersteunde versie en houd ze tot die tijd afgeschermd.

Before you start

Make a backup or snapshot of the server.
Know which PHP packages and versions are installed (see Am I affected?).
Patch at a quiet moment if you can, but don't wait long: the vulnerability is rated critical.
Verify packages from third-party repositories before you install them (see below).

Debian and Ubuntu

sudo apt update
apt list --upgradable 2>/dev/null | grep -i php
sudo apt install --only-upgrade 'php*'

Did you install PHP from a third-party repository, such as a PPA? Then the update comes from that repository. Verify it before you install it, as described below.

RHEL, AlmaLinux and Rocky Linux

sudo dnf check-update 'php*'
sudo dnf upgrade 'php*'

Using a third-party repository, such as Remi's? Then the update comes from there. Verify it before you install it, as described below.

Packages from third-party repositories

Packages from a third-party repository are built outside your distribution. Before you install them on production servers:

check that the package version matches a release published on php.net
read the repository's changelog and announcements for this update
install it on a test server first, and check its behaviour, including outgoing network traffic
when in doubt, wait for confirmation or use your distribution's own packages

Restart PHP and the web server

Debian and Ubuntu (replace 8.3 with your version)

sudo systemctl restart php8.3-fpm
sudo systemctl restart nginx    # or: apache2

RHEL, AlmaLinux and Rocky Linux

sudo systemctl restart php-fpm
sudo systemctl restart nginx    # or: httpd

Running PHP as an Apache module (mod_php)? Then restarting Apache is enough.

Docker and other containers

Pull the patched base image, rebuild your own images on top of it and redeploy. Restarting an existing container is not enough: it keeps running the old PHP.

docker pull php:8.3-fpm
docker compose build --pull
docker compose up -d

Control panels on your own server

cPanel, Plesk, DirectAdmin and similar panels ship their own PHP builds. Install the panel's updates as soon as the vendor publishes patched PHP packages, and check the PHP version afterwards.

Check that it worked

php -v
php-fpm8.3 -v    # Debian and Ubuntu; on RHEL: php-fpm -v

Also check the version the web server runs, as described in Am I affected?, and compare it with the fixed versions published on php.net.

PHP 8.1 and older

Only supported PHP versions are expected to receive an official fix. Plan an upgrade to a supported version, and test your application on it. Until then, keep these systems offline or behind a VPN or IP allow list (see Limit exposure).

After patching

Patching closes the hole, but does not remove anything an attacker may already have left behind. Check for compromise next.

Need help?

Email support@peaceweb.com from the email address of your account, with "Urgent" in the subject if it can't wait. Response times may be longer than usual.

Email support