Debian 12 (bookworm) ships PHP 8.2 as the php8.2 source package. From March 2025 to October 2026 it received eight security updates: four Debian Security Advisories (DSAs) while bookworm still had regular security support, then four Debian LTS Advisories (DLAs) from the LTS team. The latest, DLA-4848-1 on 21 October 2026, fixes the php2shell flaws that CISA lists as known exploited. Bookworm servers should be on 8.2.35-1~deb12u1 or later.
At a glance
| Advisory | Date | Fixed version | What Debian says it fixes |
|---|---|---|---|
| DSA-5878-1 | 14 Mar 2025 | 8.2.28-1~deb12u1 | 5 CVEs: denial of service or HTTP request smuggling |
| DSA-5967-1 | 28 Jul 2025 | 8.2.29-1~deb12u1 | 3 CVEs: denial of service or server-side request forgery |
| DSA-6154-1 | 2 Mar 2026 | 8.2.30-1~deb12u1 | 3 CVEs: denial of service or memory disclosure |
| DSA-6255-1 | 8 May 2026 | 8.2.31-1~deb12u1 | 8 CVEs: denial of service, SQL injection, cross-site scripting or code execution |
| DLA-4669-1 | 4 Jul 2026 | 8.2.32-1~deb12u1 | CVE-2026-14355: memory corruption in AES key wrap with padding |
| DLA-4732-1 | 11 Aug 2026 | 8.2.33-1~deb12u1 | CVE-2026-7260, CVE-2026-17543: denial of service or SQL injection |
| DLA-4819-1 | 5 Oct 2026 | 8.2.34-1~deb12u1 | 10 CVEs plus one GitHub advisory: denial of service, information disclosure, privilege escalation, incorrect TLS validation or access-control bypass |
| DLA-4848-1 | 21 Oct 2026 | 8.2.35-1~deb12u1 | CVE-2026-109618, CVE-2026-109619: remote code execution (php2shell) |
Each version includes all earlier fixes, so 8.2.35-1~deb12u1 covers the whole list.
What the updates fixed
- 2025 (DSA-5878-1, DSA-5967-1): HTTP stream wrapper header and redirect handling (for example CVE-2025-1861, redirect locations cut at 1,024 bytes), unchecked escaping errors in the pgsql extensions (CVE-2025-1735) and null bytes in hostnames (CVE-2025-1220).
- DSA-6154-1: the December 2025 upstream fixes, published for bookworm on 2 March 2026: a PDO PostgreSQL quoting crash (CVE-2025-14180), an
array_merge()heap overflow (CVE-2025-14178) and agetimagesize()memory leak (CVE-2025-14177). - DSA-6255-1: the May 2026 round, including a SOAP use-after-free that its CVE record says may allow remote code execution (CVE-2026-6722) and SQL injection in PDO Firebird (CVE-2025-14179).
- DLA-4732-1: SQL injection in
pg_insert(),pg_update(),pg_select()andpg_delete()(CVE-2026-17543) and a phar crash. Debian fixed the related GD flaw in bookworm's libgd2 library by DLA-4731-1 (2.3.3-9+deb12u1, binary packagelibgd3). - DLA-4819-1: the September 2026 round, including credential leaks on HTTP redirects (CVE-2026-91766) and an IPv6 bypass of PHP-FPM's
listen.allowed_clients(CVE-2026-91768). - DLA-4848-1: two vulnerabilities Debian calls critical, in out-of-memory handling and in request state that can outlive its memory. See our php2shell article.
Are you affected?
dpkg -l 'php8.2*' | awk '/^ii/ {print $2, $3}'
apt policy php8.2-fpm php8.2-cli libapache2-mod-php8.2 libgd3Anything below 8.2.35-1~deb12u1 is missing at least the php2shell fix. If apt policy shows PHP coming from a third-party repository, these Debian versions do not apply; compare with upstream PHP 8.2.35 instead.
How to update
DLAs arrive through the same bookworm-security archive as DSAs did, so the usual commands work:
sudo apt update
sudo apt upgradeOur guide to automatic security updates on Debian shows how to apply them unattended.
Restart or reboot?
No reboot. Restart PHP-FPM, Apache with mod_php and long-running PHP workers:
sudo systemctl restart php8.2-fpm
sudo systemctl restart apache2 # if libapache2-mod-php8.2 is installedPlan beyond 2026
Bookworm's regular support ended in July 2026 and its LTS period runs until 30 June 2028. The PHP project's own security support for 8.2 ends on 31 December 2026, so after that date bookworm's php8.2 depends on fixes that the LTS team prepares. Debian 13 (trixie) ships PHP 8.4, which the PHP project supports with security fixes until 31 December 2028. Debian 11 (bullseye) reached the end of LTS on 31 August 2026; servers still on it should be upgraded.
Sources
- security-tracker.debian.org/tracker/DSA-5878-1
- lists.debian.org/debian-security-announce/2025/msg00040.html
- security-tracker.debian.org/tracker/DSA-5967-1
- lists.debian.org/debian-security-announce/2025/msg00131.html
- security-tracker.debian.org/tracker/DSA-6154-1
- lists.debian.org/debian-security-announce/2026/msg00063.html
- security-tracker.debian.org/tracker/DSA-6255-1
- lists.debian.org/debian-security-announce/2026/msg00166.html
- security-tracker.debian.org/tracker/DLA-4669-1
- lists.debian.org/debian-lts-announce/2026/07/msg00010.html
- security-tracker.debian.org/tracker/DLA-4732-1
- lists.debian.org/debian-lts-announce/2026/08/msg00022.html
- security-tracker.debian.org/tracker/DLA-4819-1
- lists.debian.org/debian-lts-announce/2026/10/msg00011.html
- security-tracker.debian.org/tracker/DLA-4848-1
- lists.debian.org/debian-lts-announce/2026/10/msg00042.html
- lists.debian.org/debian-lts-announce/2026/08/msg00021.html
- security-tracker.debian.org/tracker/php8.2
- packages.debian.org/source/bookworm/php8.2
- debian.org/releases
- wiki.debian.org/LTS
- wiki.debian.org/LTS/Using
- php.net/supported-versions.php
- cve.org/CVERecord?id=CVE-2026-109618
- cisa.gov/known-exploited-vulnerabilities-catalog
Comments
0 total · 0 threads