Debian 13 (trixie) ships PHP 8.4 as the php8.4 source package. Between December 2025 and October 2026 the Debian security team published six advisories for it, each moving trixie to the matching upstream 8.4 point release. The latest, DSA-6574-1 on 21 October 2026, fixes the two php2shell vulnerabilities, which CISA has listed as known exploited since 26 October 2026. If your trixie servers are not on 8.4.27-1~deb13u1, update now.
At a glance
| Advisory | Date | Fixed version | What Debian says it fixes |
|---|---|---|---|
| DSA-6088-1 | 21 Dec 2025 | 8.4.16-1~deb13u1 | 3 CVEs: denial of service or memory disclosure |
| DSA-6256-1 | 8 May 2026 | 8.4.21-1~deb13u1 | 11 CVEs: denial of service, SQL injection, cross-site scripting, information disclosure or code execution |
| DSA-6377-1 | 4 Jul 2026 | 8.4.23-1~deb13u1 | CVE-2026-14355: memory corruption in AES key wrap with padding |
| DSA-6406-1 | 31 Jul 2026 | 8.4.24-1~deb13u1 | 3 CVEs: denial of service, SQL injection, information disclosure or code execution |
| DSA-6514-1 | 25 Sep 2026 | 8.4.26-1~deb13u1 | 10 CVEs: denial of service, information disclosure, incorrect TLS certificate validation or access-control bypass |
| DSA-6574-1 | 21 Oct 2026 | 8.4.27-1~deb13u1 | CVE-2026-109618, CVE-2026-109619: code execution (php2shell) |
Each fixed version supersedes the earlier ones, so a server on 8.4.27-1~deb13u1 has every fix in this list.
What the updates fixed
- DSA-6088-1 carried the December 2025 upstream fixes: a crash in PDO PostgreSQL quoting (CVE-2025-14180), a heap overflow in
array_merge()(CVE-2025-14178) and a memory leak ingetimagesize()(CVE-2025-14177). - DSA-6256-1 brought the May 2026 round, including a SOAP use-after-free that its CVE record says may allow remote code execution (CVE-2026-6722), SQL injection in PDO Firebird (CVE-2025-14179) and cross-site scripting in the PHP-FPM status page (CVE-2026-6735).
- DSA-6377-1 fixed a buffer overflow in
openssl_encrypt()with AES key wrap with padding. - DSA-6406-1 fixed SQL injection in
pg_insert(),pg_update(),pg_select()andpg_delete()(CVE-2026-17543), an out-of-bounds write inbccomp()(CVE-2026-17544) and a phar crash (CVE-2026-7260). The related GD flaw is fixed in trixie's separate libgd2 library by DSA-6409-1 (2.3.3-14~deb13u1, binary packagelibgd3). - DSA-6514-1 brought the September 2026 round: credential leaks on HTTP redirects, TLS hostname-check flaws, an IPv6 access-control bypass in PHP-FPM's
listen.allowed_clients(CVE-2026-91768) and a SOAP server crash (CVE-2026-91765). - DSA-6574-1 fixed the php2shell flaws, which Debian describes as incorrect memory state tracking that could result in the execution of arbitrary code. Details are in our php2shell article.
Are you affected?
Check which php8.4 packages are installed, their version and the repository they come from:
dpkg -l 'php8.4*' | awk '/^ii/ {print $2, $3}'
apt policy php8.4-fpm php8.4-cli libapache2-mod-php8.4If the installed version is lower than 8.4.27-1~deb13u1, at least the php2shell fix is missing. If apt policy shows PHP coming from a third-party repository rather than Debian, the DSA versions above do not apply; follow that repository's updates and compare against upstream PHP 8.4.27. Debian 12 (bookworm) uses php8.2 instead, which receives fixes from the Debian LTS team.
How to update
sudo apt update
sudo apt upgrade # upgrades all installed php8.4-* packages and libgd3 togetherTo receive future DSAs automatically, see our guide to automatic security updates on Debian.
Restart or reboot?
No reboot is needed. PHP-FPM and Apache keep the old code loaded until they restart:
sudo systemctl restart php8.4-fpm
sudo systemctl restart apache2 # if libapache2-mod-php8.4 is installedRestart queue workers and other long-running PHP processes too, then confirm with php -v.
Sources
- security-tracker.debian.org/tracker/DSA-6088-1
- lists.debian.org/debian-security-announce/2025/msg00254.html
- security-tracker.debian.org/tracker/DSA-6256-1
- lists.debian.org/debian-security-announce/2026/msg00167.html
- security-tracker.debian.org/tracker/DSA-6377-1
- lists.debian.org/debian-security-announce/2026/msg00288.html
- security-tracker.debian.org/tracker/DSA-6406-1
- lists.debian.org/debian-security-announce/2026/msg00317.html
- security-tracker.debian.org/tracker/DSA-6514-1
- lists.debian.org/debian-security-announce/2026/msg00427.html
- security-tracker.debian.org/tracker/DSA-6574-1
- lists.debian.org/debian-security-announce/2026/msg00489.html
- debian.org/security/2026/dsa-6574
- lists.debian.org/debian-security-announce/2026/msg00320.html
- security-tracker.debian.org/tracker/php8.4
- packages.debian.org/source/trixie/php8.4
- cve.org/CVERecord?id=CVE-2026-109618
- cve.org/CVERecord?id=CVE-2026-109619
- cisa.gov/known-exploited-vulnerabilities-catalog
- php.net/archive/2026.php
Comments
0 total · 0 threads