Debian 11 Default PHP Version and PHP2Shell

Short answer

Debian 11 ships PHP 7.4 by default. Debian adds security fixes to its own PHP packages without changing PHP's version number, so whether a server has the PHP2Shell fix depends on its package update, shown in the distribution's security tracker. Run apt list --installed 'php7.4*' to see yours.

default on Debian 11: PHP 7.4
free security support: Ended

Which PHP version does Debian 11 use?

Debian 11 (bullseye) ships PHP 7.4 as its default php7.4 packages. On a server like this, php -v reports something like PHP 7.4.33-1+deb11uN. The part after the dash is Debian's own package revision. Debian's free Long Term Support for it ended on August 31, 2026.

Is PHP on Debian 11 affected by PHP2Shell?

It depends on Debian's package, not on the version number alone. Linux distributions add security fixes to their own PHP packages (backports) without moving to PHP's new version numbers. So a server reporting 7.4.33-1+deb11uN can have the fix even though PHP's own fixed releases are 8.2.35, 8.3.36, 8.4.27, 8.5.12. Debian's security tracker shows whether a fixed package is out for Debian 11:

Debian 11's free security support has ended, and PHP 7.4 reached end of life upstream too. Plan a move to a supported release of Debian or Ubuntu with a supported PHP.

How to check your PHP package on the server

Connect to the server over SSH (or ask whoever manages it).
Run php -v to see the PHP version and package revision.
Run apt list --installed 'php7.4*' to list the installed PHP 7.4 packages and their versions.
Run apt changelog php7.4-fpm | head -40 (or php7.4-cli) and look for CVE-2026-109618 or CVE-2026-109619 in the latest entries.
If the fix is out but not installed, run sudo apt update && sudo apt upgrade, then restart PHP-FPM or your web server.

If you installed PHP from Ondřej Surý's packages

Many servers run PHP from Ondřej Surý's repository (ppa:ondrej/php on Ubuntu, packages.sury.org on Debian) instead of the default packages. Those follow PHP's own version numbers, so look for the fixed release for your line: 8.5.12 for 8.5, 8.4.27 for 8.4, 8.3.36 for 8.3, 8.2.35 for 8.2.

What PHP Scanner shows for these servers

When a server reports a Debian PHP build, PHP Scanner says "Check with your host" with a Medium rating, because the version number can't tell us whether the backported fix is in. Your result includes an email to send your host asking them to confirm.

Questions people ask

What is the default PHP version on Debian 11?

PHP 7.4, from the php7.4 packages. Many servers add a newer PHP from Ondřej Surý's repository instead.

Does Debian 11 fix PHP2Shell without a new PHP version?

Debian patches its own PHP packages and keeps the original version number. Its security tracker shows whether a fixed package has been published for Debian 11.

Is PHP 7.4 on Debian 11 still supported?

Debian's free Long Term Support for it ended on August 31, 2026. PHP's own support for 7.4 is listed on our PHP 7.4 page.

Sources

Checked against these sources on October 22, 2026. PHP Scanner is a free tool from Catch Digital and is not affiliated with the PHP project.