Debian 12 Default PHP Version and PHP2Shell

Short answer

Debian 12 ships PHP 8.2 by default. Debian adds security fixes to its own PHP packages without changing PHP's version number, so whether a server has the PHP2Shell fix depends on its package update, shown in the distribution's security tracker. Run apt list --installed 'php8.2*' to see yours.

default on Debian 12: PHP 8.2
security maintenance until: Jun 2028

Which PHP version does Debian 12 use?

Debian 12 (bookworm) ships PHP 8.2 as its default php8.2 packages. On a server like this, php -v reports something like PHP 8.2.x-1~deb12uN. The part after the dash is Debian's own package revision. Debian's Long Term Support team covers it from June 11, 2026 to June 30, 2028.

Is PHP on Debian 12 affected by PHP2Shell?

It depends on Debian's package, not on the version number alone. Linux distributions add security fixes to their own PHP packages (backports) without moving to PHP's new version numbers. So a server reporting 8.2.x-1~deb12uN can have the fix even though PHP's own fixed releases are 8.2.35, 8.3.36, 8.4.27, 8.5.12. Debian's security tracker shows whether a fixed package is out for Debian 12:

How to check your PHP package on the server

Connect to the server over SSH (or ask whoever manages it).
Run php -v to see the PHP version and package revision.
Run apt list --installed 'php8.2*' to list the installed PHP 8.2 packages and their versions.
Run apt changelog php8.2-fpm | head -40 (or php8.2-cli) and look for CVE-2026-109618 or CVE-2026-109619 in the latest entries.
If the fix is out but not installed, run sudo apt update && sudo apt upgrade, then restart PHP-FPM or your web server.

If you installed PHP from Ondřej Surý's packages

Many servers run PHP from Ondřej Surý's repository (ppa:ondrej/php on Ubuntu, packages.sury.org on Debian) instead of the default packages. Those follow PHP's own version numbers, so look for the fixed release for your line: 8.5.12 for 8.5, 8.4.27 for 8.4, 8.3.36 for 8.3, 8.2.35 for 8.2.

What PHP Scanner shows for these servers

When a server reports a Debian PHP build, PHP Scanner says "Check with your host" with a Medium rating, because the version number can't tell us whether the backported fix is in. Your result includes an email to send your host asking them to confirm.

Questions people ask

What is the default PHP version on Debian 12?

PHP 8.2, from the php8.2 packages. Many servers add a newer PHP from Ondřej Surý's repository instead.

Does Debian 12 fix PHP2Shell without a new PHP version?

Debian patches its own PHP packages and keeps the original version number. Its security tracker shows whether a fixed package has been published for Debian 12.

Is PHP 8.2 on Debian 12 still supported?

Debian's Long Term Support team covers it from June 11, 2026 to June 30, 2028. PHP's own support for 8.2 is listed on our PHP 8.2 page.

Sources

Checked against these sources on October 22, 2026. PHP Scanner is a free tool from Catch Digital and is not affiliated with the PHP project.