Every PHP version from 5.5 to 8.4 as .deb packages from a signed repository for Ubuntu 14.04 to 24.04 and Debian 10. All builds contain the fixes for the critical RCE vulnerabilities of 21 October 2026, including the branches PHP itself no longer maintains. Plus current PHP 8.3 for Ubuntu 16.04, 18.04 and 20.04. One repository, one apt line, no migration.
Purely digital service: credentials by email within 24 hours, software download via apt. No hardware, nothing shipped. Billing via Paddle, invoice with VAT shown.
$ lsb_release -ds Ubuntu 18.04.6 LTS $ sudo apt install php8.3-fpm php8.3-cli Reading package lists... Done Setting up php8.3-cli (8.3.36-1~bionic) ... Setting up php8.3-fpm (8.3.36-1~bionic) ... $ php8.3 -v PHP 8.3.36 (cli) (built: Oct 23 2026) (NTS)
On 21 October 2026 PHP disclosed two vulnerabilities that let unauthenticated requests execute code on the server. Every PHP installation serving web requests is affected: PHP-FPM, Apache with mod_php, php-cgi. PHP rates the risk highest for mod_php, because the attack lands before any application code runs.
PHP itself fixed only 8.2 to 8.5. If you run 8.1, 8.0, 7.x or 5.5, you get no fix from PHP and none from your distribution. In this repository all ten versions carry the fix for these two vulnerabilities.
Out-of-memory handling can interrupt PHP while internal request data is only partially initialised. Request cleanup then treats the invalid data as valid.
GHSA-w8hw-w9fx-j79w on GitHubRequest-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker uses the stale state before normal initialisation resets it.
GHSA-6wmf-4rv5-p3rp on GitHubFor 8.2, 8.3 and 8.4 we ship the official fix releases 8.2.35, 8.3.36 and 8.4.27. For 8.1, 8.0, 7.4, 7.3, 7.2, 7.0 and 5.5, PHP no longer publishes updates. We patched those branches ourselves: the same two fixes, backported and rebuilt.
All builds date from 21 to 26 October 2026, the days right after the advisory, each including libapache2-mod-php, the path with the highest risk.
| Distribution | Fixed versions in the repository |
|---|---|
| Ubuntu 24.04 | 8.4.278.3.36 |
| Ubuntu 22.04 | 8.4.278.3.368.1.348.0.30 |
| Ubuntu 20.04 | 8.3.368.2.358.1.348.0.307.4.33 |
| Ubuntu 18.04 | 8.3.368.2.358.1.348.0.307.4.337.3.337.2.34 |
| Ubuntu 16.04 | 8.3.368.1.348.0.307.4.337.3.337.2.347.0.33 |
| Debian 10 | 8.3.368.0.307.4.33 |
| Ubuntu 14.04 | 5.5.9 |
On 26 October 2026 we had several production servers running packages from this repository scanned from the outside with the PHP2Shell scanner by Pentest-Tools.com. The scanner tests specifically for CVE-2026-109618 and CVE-2026-109619, which became known as PHP2Shell.
Result of every scan: “Target is not vulnerable to PHP2Shell.” No findings at the Critical, High, Medium or Low levels. The card on the right shows one of these scans.
Every administrator knows at least one server that must not be touched. The distribution there ships PHP in a version that has not seen a release in years.
Old customer projects, control panels, custom-built modules, compliance freezes. A dist-upgrade on a production 16.04 or 18.04 is a project, not a maintenance window.
Laravel, Symfony, WordPress plugins, Composer dependencies: at some point the toolchain demands a PHP version your distribution will never get.
Ubuntu 14.04 ships PHP 5.5, 16.04 ships 7.0, 18.04 ships 7.2, Debian 10 ships 7.3. Building it yourself means maintaining a build environment, resolving dependencies, and starting over with every release.
patchdeb decouples PHP from the operating system. You add one repository and install the PHP version your application needs. The system underneath stays as it is.
apt install in three steps.Up to 100, 300 or 1,000 servers, as an annual subscription. Checkout runs through Paddle. You receive an invoice with VAT shown.
You receive your repository credentials and the public repository key. Within 24 hours of ordering at the latest, usually much sooner.
One line in sources.list, drop in the key, apt install. All via the normal apt path your automation already knows.
All packages are built for amd64 and named by Debian convention; the repository's package index is GPG-signed. Every PHP version ships CLI, FPM, the Apache module and the matching extension packages.
| Suite | System | PHP versions | Binary packages |
|---|---|---|---|
| noble | Ubuntu 24.04 | 8.4.278.3.36 | 87 |
| jammy | Ubuntu 22.04 | 8.4.278.3.368.1.348.0.30 | 175 |
| focal | Ubuntu 20.04 | 8.3.368.2.358.1.348.0.307.4.33 | 222 |
| bionic | Ubuntu 18.04 | 8.3.368.2.358.1.348.0.307.4.337.3.337.2.34 | 314 |
| xenial | Ubuntu 16.04 | 8.3.368.1.348.0.307.4.337.3.337.2.347.0.33 | 314 |
| buster | Debian 10 | 8.3.368.0.307.4.33 | 134 |
| trusty | Ubuntu 14.04 | 5.5.9 php5-*, mod_php | 30 |
libapache2-mod-php| Suite | mod_php available for |
|---|---|
| noble | 8.48.3 |
| jammy | 8.48.38.18.0 |
| focal | 8.38.28.18.07.4 |
| bionic | 8.38.28.18.07.47.37.2 |
| xenial | 8.38.18.07.47.37.27.0 |
| buster | 8.38.07.4 |
| trusty | php5 (5.5.9) additionally php5filter |
php8.3-fpm and php7.4-fpm install next to each other. Switch per FPM pool or with update-alternatives.apt update, apt verifies the index and the SHA256 checksum of every package, just as with the distribution's own packages. The individual .deb files carry no signature of their own.You pay for access to the repository, tiered by the number of your servers. Not by PHP version, not by distribution. Every plan is a digital annual subscription: you receive credentials for a software repository and use it on your own servers. No hardware, no physical delivery.
All prices exclude VAT. Payment processing and invoicing by Paddle.com as merchant of record. With a valid VAT ID, EU customers are billed under the reverse-charge procedure.
You purchase access to the repository in its current state, not the software and no entitlement to further builds or updates. PHP is open source and licensed under the PHP License.
More than 1,000 servers? Write to us and we'll make you an offer.
No agents, no extra software. The credentials live in apt's own auth.conf, the key in the keyring. Ansible, Puppet or a shell script roll that out to the whole fleet in minutes.
/etc/apt/auth.conf instead of auth.conf.d/.apt-key add, as apt 1.0 does not know signed-by.trusty, xenial, bionic, focal, jammy, noble or buster.# 1. Install the repository key curl -fsSL https://repo.patchdeb.de/patchdeb.gpg \ | sudo tee /usr/share/keyrings/patchdeb.gpg >/dev/null # 2. apt credentials (from your activation email) printf 'machine repo.patchdeb.de login CUSTOMER password TOKEN\n' \ | sudo tee /etc/apt/auth.conf.d/patchdeb.conf >/dev/null sudo chmod 600 /etc/apt/auth.conf.d/patchdeb.conf # 3. Add the repository, example Ubuntu 18.04 "bionic" echo "deb [signed-by=/usr/share/keyrings/patchdeb.gpg] \ https://repo.patchdeb.de/ bionic main" \ | sudo tee /etc/apt/sources.list.d/patchdeb.list sudo apt update sudo apt install php8.3-fpm php8.3-cli
A purely digital product: access to our APT repository for the term of your subscription, in its current state: 1,276 packages in the signed repository, built between 21 and 26 October 2026, including the emergency patch for the two RCE vulnerabilities in the branches PHP itself no longer maintains. Nothing more and nothing less. Further builds or updates are not part of the subscription. The software itself is not sold: PHP is open source and licensed under the PHP License.
No. patchdeb is a digital subscription. You receive credentials and the repository key by email; apt downloads the software packages over the internet onto your own servers. There is no hardware, no media and no shipping. The servers you install the packages on are yours and are not provided by us.
Yes. PHP is open source and licensed under the PHP License, which expressly permits redistribution, including of modified builds. We build the packages ourselves from the official source packages, backport the two CVE fixes and sign the package index with our key. What is sold is access to our repository as a service, not the software.
Yes, in every version in the repository, from 5.5.9 to 8.4.27. For 8.2, 8.3 and 8.4 these are PHP's official fix releases. For 8.1 and older, for which PHP no longer publishes updates, we backported the two fixes and rebuilt the packages. All builds date from 21 to 26 October 2026 and each includes mod_php.
For 8.1 and older this is expressly an emergency patch: it closes exactly these two holes. Other vulnerabilities disclosed in these branches since their end of life remain, just as in the packages you run today. Apart from that, the builds match the last upstream release.
We had the fix verified from the outside: scans with the PHP2Shell scanner by Pentest-Tools.com on 26 October 2026 report “not vulnerable” for several servers running packages from this repository, with no findings at any level.
A host that uses the repository, physical or virtual. How many PHP versions you install on that host does not matter.
Within 24 hours of ordering you receive your credentials and the public repository key by email.
amd64. That covers practically every server running Ubuntu 14.04 to 24.04 or Debian 10 in production.
Yes. The packages follow the Debian convention of versioned names such as php8.3-fpm and php7.4-fpm. They run next to each other; you choose the version per vhost or FPM pool. That is the usual way to migrate an application step by step.
No, we do not promise that. The subscription covers access to the repository as of 26 October 2026, with all 1,276 packages and the emergency patches for the two RCE vulnerabilities. Further builds, new PHP releases or updates to existing packages are not part of the subscription and are not promised.
Through Paddle.com as merchant of record. You pay by credit card, PayPal or one of the other payment methods Paddle offers and receive an invoice with VAT shown. With a valid VAT ID, EU customers are billed under the reverse-charge procedure.
The subscription runs for one year and renews for another year unless you cancel. You can cancel at any time with effect from the end of the term, through the Paddle customer portal or by email to us.
Yes, at patchdeb.de. Repository, packages and prices are identical.
Order today, add the repository tomorrow and close the holes on every server with one apt upgrade. Questions beforehand? Email us.