How to check PHP security backports on Ubuntu and Debian

Why an old-looking PHP version can include a fix

A security backport brings a fix from newer software into an older release. Ubuntu explains that it generally supplies security updates this way to preserve compatibility. Debian gives the same reason: changing fewer parts of a stable release reduces unexpected changes for users. Both distributions publish information you can use to check a specific package. Ubuntu security update policy; Debian security FAQ.

Read the complete package version. In Debian's package format, it can include an epoch, an upstream version and a distribution revision. The epoch is an optional number before a colon. The revision records the distribution's packaging changes. Removing that revision discards information needed for an advisory comparison. Debian package version format.

Security backporting also differs from Debian Backports, a separate package service that brings newer software to stable releases. Its security updates are handled on a best-effort basis by package backporters. You do not need to add that repository merely because an advisory discusses a backported security fix. Debian Backports FAQ.

Find the release and full package version

Run checks in the environment that contains PHP. For a container, that means its own environment, rather than assuming packages on the host describe packages inside it. Start with operating system identification:

cat /etc/os-release

Record ID, VERSION_ID and the release codename if provided. This file identifies the operating system visible in that environment. It does not identify a PHP package supplier or establish its security coverage. os-release documentation.

Next, list PHP packages and their installation status. The following query normally needs no elevated access:

dpkg-query -W -f='${binary:Package}\t${Version}\t${Architecture}\t${db:Status-Status}\t${source:Package}\t${source:Version}\n' \
  'php*-cli' 'php*-fpm' 'php*-common' 'libapache2-mod-php*'

Columns show the binary package name, installed version, architecture, package state, source package name and source version. A source package supplies the code used to build related binary packages, such as CLI and FPM. Use rows whose state is installed; other states need separate attention. An unmatched pattern may report that no packages were found. This inventory does not find a custom PHP build outside the package database. dpkg-query manual.

For the package you identified, inspect the repository information available to APT, Debian and Ubuntu's package tool. Replace this example package name with yours:

apt-cache policy php8.3-fpm

Read the installed version, candidate version, repository addresses and priorities together. APT's candidate is the version selected by its current package rules. Its cached metadata can be old, so matching installed and candidate versions can leave a newer security build undiscovered. This command inspects metadata and does not install an update. apt-cache manual.

If the package comes from a third-party repository, a control panel or a custom build, obtain that supplier's advisory and build details. A matching PHP branch number does not make an Ubuntu or Debian package notice apply to a different supplier's build.

Match the package to the right advisory

Write down the vulnerability identifier you are checking, usually a CVE number. On Ubuntu, open its CVE page and any linked Ubuntu Security Notice. Ubuntu tracks vulnerability status separately from notices announcing published fixes. Read the row for your operating system release and relevant source package, then compare the full installed build with the notice's package list. Ubuntu vulnerability status and notices.

On Debian, start with the Debian Security Tracker. Search the CVE or source package. A source-package page, such as Debian's php8.2 page, collects issues and announcements. Open the individual issue to read release-specific status and notes, alongside the source-package page's available-version list.

1. Match the distribution, release, package supplier and source package.
2. Read the issue's status and any explanation of why a release is affected or unaffected.
3. If a fix exists, compare the exact package build with the correct release's fixed build.
4. Check relevant binary packages and extensions, then verify the running web processes.

Use Debian's version comparison rules for package versions. They account for characters such as ~ and optional epochs. Ordinary alphabetical sorting or a comparison that keeps only three numbers can give the wrong order. Package version ordering.

The following comparison is only for an official Ubuntu 24.04 php8.3-fpm package being checked against the dated USN example above. Confirm that scope before using it:

dpkg --compare-versions "$(dpkg-query -W -f='${Version}' php8.3-fpm)" ge '8.3.6-0ubuntu0.24.04.13'
printf 'Comparison exit status: %s\n' "$?"

ge means greater than or equal to. Exit status 0 means that comparison is true; 1 means false. Treat a failed package query or an error as an incomplete check. A true comparison only establishes version ordering within the package context you confirmed. It does not inspect a running PHP process. dpkg comparison command.

Coverage also needs checking. Ubuntu's support depends on the release, repository and maintenance service. Read the package-specific scope, including whether extended maintenance applies. Ubuntu security repositories and coverage.

Find the PHP serving your website

A terminal check starts a PHP program selected by your shell. These commands identify that command-line interface, or CLI, and the configuration it loads:

command -v php
php -v
php --ini

php -v reports the invoked binary's version and interface. php --ini lists its configuration files. Neither command asks an existing web worker what it is running. Even starting php-fpm8.3 -v reads the FPM executable currently available on disk, rather than querying an already running worker. PHP command-line options.

Trace one site's configured PHP handler. With PHP-FPM, the web server sends PHP requests to a pool of workers through a socket or network address. Match the site's destination to the pool's listen setting and then its service. A machine can have several pools and versions, so finding one active FPM service does not identify every site's PHP. PHP-FPM overview; FPM pool settings.

Apache can forward requests to FPM through mod_proxy_fcgi, or load PHP as an Apache module. Those arrangements have different processes to inspect. For FPM, follow the configured backend. For an Apache PHP module, examine the Apache processes and their loaded PHP library. Apache's name alone does not tell you which arrangement a site uses. Apache FastCGI module documentation; PHP interface types.

If your existing private application diagnostics report a PHP interface, fpm-fcgi indicates FPM and apache2handler indicates the Apache module. Keep that observation tied to the specific request and backend. A public phpinfo() page can reveal environment data, paths, headers and configuration; use an existing protected diagnostic route or ask the administrator for the needed details. PHP interface names; Information exposed by phpinfo().

Compare running processes with installed files

Installing a package changes files on disk. A process may still refer to an executable or library that has since been replaced. Check the actual service and workers before concluding that your website uses the package build you found.

Identify the service and its processes

On a server managed by systemd, these queries help locate candidate services and inspect one service. Names are examples:

systemctl list-units --type=service --all 'php*-fpm.service' 'apache2.service' 'nginx.service'
systemctl show php8.3-fpm.service -p MainPID -p ExecStart -p ExecMainStartTimestamp

MainPID is systemd's current main process identifier. ExecStart describes the service's start command, and the timestamp helps place its main process in time. These fields do not inventory every worker or prove that a site sends traffic to that service. A zero PID or missing service means this route has not identified an active main process. Read access is usually available without administrator rights, subject to local restrictions. systemctl queries; systemd service properties.

Replace 1234 with the identified main PID. List that process and its direct children:

ps -p 1234 -o pid,ppid,lstart,args
ps --ppid 1234 -o pid,ppid,lstart,args

This is a momentary process snapshot. Check all relevant workers and additional services, including processes completing earlier requests. A start time older than a package change is a reason to investigate, rather than proof of a vulnerable build. Process details may be restricted by the host. ps manual.

Inspect the executable and mapped libraries

Linux exposes information about a process under /proc/PID. These examples may require administrator access because they inspect another user's processes. Use only access you are authorized to use, and substitute a current PID:

sudo readlink /proc/1234/exe
sudo grep -E 'php|\(deleted\)' /proc/1234/maps

exe points to the program the process executed. If that executable was unlinked, Linux appends (deleted) to the link text. That establishes that the old file was unlinked; it does not identify its package revision or decide whether it contains a particular vulnerability. If you cannot read the link, record that the executable was not checked. Linux /proc/PID/exe documentation.

maps lists files mapped into process memory. The filter highlights paths containing php and mappings marked (deleted). Read the complete relevant entries. An Apache executable path will usually identify Apache itself; a loaded PHP module must be traced through its library mapping. Deleted mappings can belong to unrelated files, and a PHP-related path may use an unexpected name. A short filtered list cannot certify that every loaded component is current. Linux mapped-file documentation.

For an FPM executable on the same ordinary host filesystem, you can also compare its running executable file with the installed path. First confirm the real path and package owner; these are examples:

dpkg-query -S /usr/sbin/php-fpm8.3
sudo cmp /proc/1234/exe /usr/sbin/php-fpm8.3

cmp returns 0 for matching file contents, 1 for different contents and 2 for an error. A match means the running FPM executable has the same bytes as the file on disk at that moment. This comparison does not check loaded libraries, authenticate the installed package or identify the backend serving a request. An Apache executable comparison does not compare its PHP module. cmp manual; Package file ownership queries.

Keep package queries and file comparisons in the same environment. Containers, separate filesystems and restricted /proc access can make a host pathname refer to a different file or hide processes. If you cannot establish that relationship, leave runtime status unresolved and ask the host or administrator to confirm it.

Record findings and choose the next step

Keep a short record for each site or backend. This makes a hosting support request or a maintenance plan more useful:

If the relevant build is missing, plan the distribution's supported fix and the service changes it requires with the server owner. If files and processes disagree, resolve that discrepancy and recheck every affected backend after maintenance. If package support has ended or your application needs a different PHP branch, plan a tested migration. Our guides cover PHP2Shell checks and verification and upgrades and extended support for older PHP.

Primary sources

Sources were checked on October 22, 2026. Advisory status and available package builds can change; reopen the relevant notice when checking a server.

• Ubuntu: security updates, coverage and notices
• Ubuntu Security Notice USN-8948-1
• Debian security FAQ and Debian Security Tracker
• Debian package version policy and Debian Backports FAQ
• PHP command-line options, FPM configuration and FPM status information
• systemctl and Linux process executable and mapped-file manuals