How to update PHP on Ubuntu with CloudPanel, step by step

If you run Ubuntu with CloudPanel, patching PHP involves updating the server packages and checking the websites afterward. Let's work through it in stages, without using an emergency patch as a reason to change the entire installation.

On October 21, 2026, PHP released critical fixes in 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Use the fixed release or a later release in the same series. Official advisory. The previous article explains the vulnerabilities; this guide focuses on applying the update.

1. Check whether this walkthrough fits your setup

These commands cover installations using versioned PHP packages managed by APT, such as php8.4-fpm. This naming pattern appears in the CloudPanel documentation. Other panels fit this walkthrough only if they use the same model.

Do not apply the selection below to Docker, manually compiled PHP, cPanel's ea-php packages or Plesk's own packages. Each requires its own procedure. The selection also excludes libapache2-mod-php modules and extensions with other prefixes: review them separately.

Have a recoverable backup of websites, databases and configuration, access to the provider's console and a maintenance window. Run the blocks separately, as root, in the same Bash session; if you use sudo, adapt the administrative commands. Do not paste everything at once.

2. See what is installed and what is in use

cat /etc/os-release
dpkg-query -W -f='${db:Status-Abbrev} ${binary:Package} ${Version}\n' 'php*'

dpkg-query lets you inspect package status, names and versions. Record the output before making changes. An old installed version does not prove that a website uses it, nor is it a reason to remove it blindly.

In CloudPanel, check each site's version under PHP Settings. Settings documentation. List cron jobs, queues and persistent processes, such as Laravel/Horizon workers. Generic php -v shows the terminal's PHP, which may differ. Do not change update-alternatives to try to resolve that difference during this maintenance.

3. Refresh the indexes and check package sources

apt-get update

If signature, download or repository errors appear, stop and resolve them before continuing, even if some indexes were updated.

Now select only the versioned PHP packages already installed, inspect their candidates and simulate:

mapfile -t php_pkgs < <(
  dpkg-query -W -f='${binary:Package} ${db:Status-Status}\n' |
    awk '$2 == "installed" && $1 ~ /^php[0-9]+[.][0-9]+([-:]|$)/ {print $1}'
)

if ((${#php_pkgs[@]} == 0)); then
  printf '%s\n' 'STOP: php_pkgs is empty.'
else
  printf '%s\n' "${php_pkgs[@]}"
  apt-cache policy "${php_pkgs[@]}"
  apt-get -s --no-remove install --only-upgrade "${php_pkgs[@]}"
fi

If you see STOP, do not continue: review how PHP was installed. The php_pkgs variable must remain available in the same session.

In apt-cache policy, check Installed, Candidate and the source. apt-cache manual. On Ubuntu 24.04, repositories must be compatible with Noble. Do not mix Noble with another distribution, such as Resolute, or add a PPA simply to make the desired version appear.

An available update is not confirmation of a security fix. Compare the full package version and revision with the vendor's advisory. A backport may retain an older version number, but requires explicit confirmation that it fixes these vulnerabilities. If the repository does not yet provide the fix, contact support and plan a compatible alternative; do not declare the server protected.

4. Review first, then install

The -s option simulates; --no-remove aborts proposals involving removals; --only-upgrade limits the requested targets to installed packages. Also check any dependencies the resolver may require. APT manual.

Review versions, dependencies, held packages, conflicts and any provider changes. If the simulation fails or something looks wrong, stop. Do not force the transaction or use full-upgrade or autoremove as a shortcut.

Once you have approved the proposal, still in the same session:

if ((${#php_pkgs[@]} > 0)); then
  apt-get --no-remove install --only-upgrade "${php_pkgs[@]}"
else
  printf '%s\n' 'STOP: php_pkgs is empty.'
fi

The command keeps interactive confirmation, without -y. Read the summary again. If a configuration-file prompt appears, compare the differences with your backup; do not indiscriminately replace the panel's settings. Wait for completion and confirm there were no errors.

5. Check the PHP actually serving your websites

Repeat the inventory and compare the installed revisions with the expected fix. Below, 8.5 is only an example: use it only if that series is installed and in use; adapt it for each series you need to check.

php8.5 -v
php-fpm8.5 -v
systemctl status php8.5-fpm --no-pager
systemctl status nginx --no-pager

These commands check on-disk binaries and service status. They do not, by themselves, prove that all old workers have been replaced. Inspect processes and the application's actual runtime version through a restricted diagnostic, without leaving a public phpinfo() page.

If old processes remain in the relevant FPM service, test its configuration and restart only that service, allowing for a brief interruption:

php-fpm8.5 -t && systemctl restart php8.5-fpm

The && prevents the restart if the test fails. The -v and -t options are documented in the PHP-FPM manual. If package installation already replaced the processes correctly, do not restart again just out of habit. Persistent queues need their own checks.

Finally, test pages, login, forms, cron and queues; watch PHP, Nginx and application logs. Updating PHP alone does not automatically require rebooting the whole server.

Maintenance is finished when the patched package is in use and the websites have been tested. If an older series has no confirmed vendor fix, plan a migration without confusing an installed package with an active service.

Sources accessed on October 21, 2026.