The Sury PHP repository vs distribution packages: trade-offs, safe setup, pinning and rollback

Debian and Ubuntu each ship one PHP branch per release. When an application needs a different branch, PHP 8.4 on Debian 12 for example, most administrators reach for the repositories maintained by Ondřej Surý: packages.sury.org/php for Debian and ppa:ondrej/php for Ubuntu. They are widely used and well made, but adding them changes how your server gets PHP updates. This guide explains the trade-offs and how to add, pin and remove them deliberately.

What the repositories are

According to deb.sury.org, Ondřej Surý is a Debian Developer who has packaged PHP for Debian since PHP 5, and the official PHP packages in Debian and Ubuntu are either his work or based on it. His repositories carry the same packaging, built for each supported distribution release, with many PHP branches installable side by side. At the time of writing, packages.sury.org/php has suites for Debian 11, 12 and 13 and for Ubuntu 22.04, 24.04 and 26.04, and publishes PHP 5.6 through 8.5, plus PHP 8.6 release candidates.

Two recent changes are worth knowing:

• The Ubuntu PPA is being merged into packages.sury.org. The Launchpad page for ppa:ondrej/php says that for Ubuntu 26.04 (resolute), packages.sury.org/php is the canonical source, that the PPA can still be used on 22.04 and 24.04, and that migration instructions for older releases will follow.
• It is largely a volunteer effort. The maintainer notes that the packaging is done mostly in his free time, asks for bug reports on the project's issue tracker, and points business users to commercial support (PHP LTS by Freexian) or donations.

Distribution packages or Sury: the trade-offs

The repository makes sense when you need a branch your release does not ship and cannot move the operating system yet, or when one server must run several PHP versions for different sites. If your release already ships a supported branch that your application can use, the distribution packages are the simpler choice.

Side effects to understand before adding it

• Its versions sort higher than the distribution's. On Debian 12, Sury's 8.2.35-1+0~20261021.94+debian12~1 outranks Debian's 8.2.35-1~deb12u1; on Ubuntu 24.04, the PPA's 8.3.36-1+ubuntu24.04.1+deb.sury.org+1 outranks Ubuntu's 8.3.6-0ubuntu0.24.04.13. The next upgrade therefore replaces your distribution's own PHP packages unless you pin.
• The metapackages point to a newer branch. In the Debian 12 suite, Sury's php and php-fpm metapackages depend on PHP 8.4. Because apt upgrade installs new packages when an upgrade needs them, a server with those metapackages can gain a whole new PHP branch.
• The CLI may switch silently. Debian-style PHP packages register /usr/bin/php through update-alternatives with a priority based on the version, so installing a newer branch makes it the default php command for cron jobs and scripts.
• It also ships libraries. The repository includes builds of libraries such as libgd3 and libpcre3, which can replace the distribution's versions used by other software.

Adding it on Debian

These are the steps from the official README at packages.sury.org/php, run as root or with sudo. Do not run a full upgrade straight afterwards; add the pin in the next section first.

sudo apt-get update
sudo apt-get -y install lsb-release ca-certificates curl
sudo curl -sSLo /tmp/debsuryorg-archive-keyring.deb https://packages.sury.org/debsuryorg-archive-keyring.deb
sudo dpkg -i /tmp/debsuryorg-archive-keyring.deb
sudo sh -c 'echo "deb [signed-by=/usr/share/keyrings/debsuryorg-archive-keyring.gpg] https://packages.sury.org/php/ $(lsb_release -sc) main" > /etc/apt/sources.list.d/php.list'
sudo apt-get update

On Ubuntu 22.04 and 24.04 the PPA is still available with sudo add-apt-repository ppa:ondrej/php; on Ubuntu 26.04 the maintainer directs users to packages.sury.org/php. Because the PPA is being merged, check the Launchpad page for current instructions before setting up a new server.

Pin it so it only provides what you want

APT preferences let you give the repository a low priority by default and raise it only for the branch you need. This example for Debian 12 takes PHP 8.4 (and the shared php-common it requires) from Sury and keeps everything else, including Debian's own PHP 8.2 and libraries, from Debian:

# /etc/apt/preferences.d/sury-php
Package: *
Pin: origin packages.sury.org
Pin-Priority: 100

Package: src:php8.4 php-common
Pin: origin packages.sury.org
Pin-Priority: 500

The wildcard record comes first so the specific one overrides it, as the apt_preferences manual advises. On Ubuntu with the PPA, match the repository with Pin: release o=LP-PPA-ondrej-php instead of the origin host. Then check the result before installing anything:

apt policy php8.4-fpm php-common libgd3 php8.2-cli
apt-get install --simulate php8.4-fpm php8.4-cli php8.4-mysql

apt policy shows the candidate version and its source for each package; the simulation shows exactly what would be installed or replaced. Extensions built from other source packages, such as php8.4-redis, may need their own entries if their dependencies require it. Adjust the pin until the simulation contains only what you intend, then install for real. Install versioned packages (php8.4-fpm, php8.4-cli) rather than the php or php-fpm metapackages, so the branch only changes when you decide.

Keeping it updated

Updates from the repository arrive through the normal apt update and apt upgrade, but they are not announced in Debian or Ubuntu security advisories. Follow php.net release announcements, check apt changelog for the packages you use, and make sure unattended upgrade tools are configured to include this origin if you rely on them; by default they only take updates from the distribution's own origins (on Debian, the Unattended-Upgrade::Origins-Pattern list).

Rolling back

1. Point the web server back to the distribution's PHP-FPM socket, if you kept that version installed.
2. Remove the packages of the branch that only Sury provided, for example:

   sudo apt remove $(dpkg-query -W -f='${Package}\n' 'php8.4*')

3. Delete /etc/apt/sources.list.d/php.list and your pin file, then run sudo apt update.
4. If Sury builds replaced distribution packages, bring them back with a temporary pin above 1000, which allows downgrades, and preview first:

   # /etc/apt/preferences.d/back-to-debian (temporary)
   Package: *
   Pin: release o=Debian
   Pin-Priority: 1001
   
   sudo apt update
   apt-get --simulate dist-upgrade
   sudo apt-get dist-upgrade

   Remove the temporary pin afterwards. On Ubuntu, use o=Ubuntu.

What you should do

• Prefer your distribution's PHP when it ships a supported branch your application can use.
• If you add the Sury repository or PPA, pin it before the first upgrade and verify with apt policy and a simulated install.
• Install versioned PHP packages, not the generic metapackages, and set the CLI with update-alternatives on purpose.
• Track updates yourself: they will not appear in Debian or Ubuntu security advisories.
• Write down how to roll back before you need to, and test it on a staging server.

Sources

• deb.sury.org
• packages.sury.org/php/README.txt
• packages.sury.org/php/dists
• packages.sury.org/php/dists/bookworm/Release
• launchpad.net/~ondrej/+archive/ubuntu/php
• ppa.launchpadcontent.net/ondrej/php/ubuntu/dists/noble/Release
• manpages.debian.org/trixie/apt/apt_preferences.5.en.html
• manpages.debian.org/trixie/apt/apt.8.en.html
• manpages.debian.org/trixie/apt/apt-get.8.en.html
• manpages.debian.org/trixie/dpkg-dev/deb-version.7.en.html
• salsa.debian.org/php-team/php/-/blob/debian/main/8.4/debian/php-cli.postinst.extra
• qa.debian.org/madison.php?package=php8.2&text=on
• people.canonical.com/~ubuntu-archive/madison.cgi?package=php8.3&text=on
• php.net/supported-versions.php
• sources.debian.org/src/unattended-upgrades/2.12/data/50unattended-upgrades.Debian