Ubuntu 24.04 LTS Default PHP Version and PHP2Shell

Short answer

Ubuntu 24.04 LTS ships PHP 8.3 by default. Ubuntu adds security fixes to its own PHP packages without changing PHP's version number, so whether a server has the PHP2Shell fix depends on its package update, shown in the distribution's security tracker. Run apt list --installed 'php8.3*' to see yours.

default on Ubuntu 24.04 LTS: PHP 8.3
security maintenance until: May 2029

Which PHP version does Ubuntu 24.04 LTS use?

Ubuntu 24.04 LTS (Noble Numbat) ships PHP 8.3 as its default php8.3 packages. On a server like this, php -v reports something like PHP 8.3.6-0ubuntu0.24.04.x. The part after the dash is Ubuntu's own package revision. Standard security maintenance runs until May 2029, and Ubuntu Pro extends it to May 2034.

Is PHP on Ubuntu 24.04 LTS affected by PHP2Shell?

It depends on Ubuntu's package, not on the version number alone. Linux distributions add security fixes to their own PHP packages (backports) without moving to PHP's new version numbers. So a server reporting 8.3.6-0ubuntu0.24.04.x can have the fix even though PHP's own fixed releases are 8.2.35, 8.3.36, 8.4.27, 8.5.12. Ubuntu's security tracker shows whether a fixed package is out for Ubuntu 24.04 LTS:

How to check your PHP package on the server

Connect to the server over SSH (or ask whoever manages it).
Run php -v to see the PHP version and package revision.
Run apt list --installed 'php8.3*' to list the installed PHP 8.3 packages and their versions.
Run apt changelog php8.3-fpm | head -40 (or php8.3-cli) and look for CVE-2026-109618 or CVE-2026-109619 in the latest entries.
If the fix is out but not installed, run sudo apt update && sudo apt upgrade, then restart PHP-FPM or your web server.

If you installed PHP from Ondřej Surý's packages

Many servers run PHP from Ondřej Surý's repository (ppa:ondrej/php on Ubuntu, packages.sury.org on Debian) instead of the default packages. Those follow PHP's own version numbers, so look for the fixed release for your line: 8.5.12 for 8.5, 8.4.27 for 8.4, 8.3.36 for 8.3, 8.2.35 for 8.2.

What PHP Scanner shows for these servers

When a server reports a Ubuntu PHP build, PHP Scanner says "Check with your host" with a Medium rating, because the version number can't tell us whether the backported fix is in. Your result includes an email to send your host asking them to confirm.

Questions people ask

What is the default PHP version on Ubuntu 24.04 LTS?

PHP 8.3, from the php8.3 packages. Many servers add a newer PHP from Ondřej Surý's repository instead.

Does Ubuntu 24.04 LTS fix PHP2Shell without a new PHP version?

Ubuntu patches its own PHP packages and keeps the original version number. Its security tracker shows whether a fixed package has been published for Ubuntu 24.04 LTS.

Is PHP 8.3 on Ubuntu 24.04 LTS still supported?

Standard security maintenance runs until May 2029, and Ubuntu Pro extends it to May 2034. PHP's own support for 8.3 is listed on our PHP 8.3 page.

Sources

Checked against these sources on October 22, 2026. PHP Scanner is a free tool from Catch Digital and is not affiliated with the PHP project.