Ubuntu 18.04 Server: How to Upgrade PHP Safely

To change PHP to the latest version on Ubuntu 18.04 Server, first check the support and compatibility of the operating system and applications, then test the new PHP on a supported Ubuntu server before switching. Simply adding external repositories and performing a full package upgrade, as in the past, does not guarantee the desired PHP version or that the web server uses it.

Points to check first on Ubuntu 18.04

General security maintenance for Ubuntu 18.04 LTS ended in May 2023. Ubuntu Pro's extended security maintenance (ESM) provides additional security patches for applicable packages, but it does not mean support for all external repositories or all PHP versions. Check the support period of Ubuntu 18.04 and the coverage of your current subscription and packages.

You should distinguish between the versions supported by the PHP project and the packages for which the distribution provides security patches. Even if the version numbers of Ubuntu packages remain the same, security fixes may be applied, whereas external packages do not automatically receive Ubuntu Pro guarantees. Check both the officially supported PHP versions and the package provider's policy.

In the long term, it is recommended to install a supported Ubuntu LTS on a new server and move the service. When upgrading the existing server in place, you cannot skip LTS versions, so you need to move from 18.04 to 20.04 first and proceed sequentially. For detailed steps, see Ubuntu Server Upgrade Guide.

Check the current PHP and web server configuration

Before changing the production server, record the command-line interface (CLI) version, loaded extensions, and installed packages. The following commands retrieve information, but some commands may fail if PHP is not installed.

lsb_release -a
php -v
php --ini
php -m
dpkg -l 'php*' | grep '^ii'
apt-cache policy php

php -v is the CLI version. The version and settings of the Apache module or PHP-FPM (FastCGI Process Manager) used for web requests may differ. In Apache, check active modules with apache2ctl -M, and in Nginx or Apache site configurations, check the socket or address that FastCGI points to. Whether PHP-FPM is used should be checked together with the service list and web server settings.

systemctl list-units --type=service --all 'php*-fpm.service'
sudo apache2ctl -M

On servers not using Apache, there is no need to run the second command. Back up the configuration files, site files, databases, and uploaded files, and review the restoration procedures. Keep settings containing passwords or personal information safely.

Choosing a new version and preparing a test environment

1. Check which PHP versions are supported by the application, plugins, and dependencies. Major version changes in PHP may cause incompatible behavior, so review the PHP migration guide from the current version to the target version.
2. Select a supported Ubuntu and PHP combination and prepare a test server separated from the production environment. Use restorable backups and pay attention to protecting actual user data.
3. Record the required PHP extensions and find packages suitable for the new environment. The need for database drivers, image processing, XML, ZIP, etc., varies depending on the application.
4. On the test server, check login, database connections, file uploads, scheduled tasks, and main screens, and review error logs. If there are issues, modify the application and extensions, then test again.

Example: Installing PHP 8.3 on an Ubuntu 24.04 test server

Below is an example of installing PHP 8.3 CLI and PHP-FPM on a new Ubuntu 24.04 LTS test server, not Ubuntu 18.04. PHP 8.3 does not always mean it is the latest version. Check the support period for the selected Ubuntu version and the PHP 8.3 package list for Ubuntu 24.04, and add only the extensions required by your app.

First, review package candidates and the change plan. If there are no candidates or the removal/change list is different from expected, do not install, and check the repository and dependencies.

sudo apt update
apt-cache policy php8.3-cli php8.3-fpm
apt-get -s install php8.3-cli php8.3-fpm

If the results on the test server are appropriate, install and check the status. The command below does not configure the web server to automatically use PHP-FPM.

sudo apt install php8.3-cli php8.3-fpm
php8.3 -v
php8.3 -m
systemctl status php8.3-fpm --no-pager

For example, if an app requires MySQL or MariaDB connections, review php8.3-mysql separately in that environment. Since configuration files and extensions may differ between CLI and FPM, check the settings and services of the new FPM. After installing the package, adjust the web server’s FastCGI settings to match the FPM socket of the test server, and after passing the web server configuration check, reload it. The Apache module method is configured separately and should not be confused with FPM.

Verify the web configuration and recover from problems

You cannot check the PHP version of a website using only the CLI version. Verify the active settings of the web server along with FPM services and logs, and in a restricted test environment, confirm through the application’s status page or administration tools whether web requests are using the new PHP. Do not leave a phpinfo() page that exposes detailed server settings in a publicly accessible location.

Before the actual transition, plan a maintenance window, data synchronization, and recovery points. After switching services, check key functions and the web server and PHP error logs. If there are issues, revert to the previously saved web server connection settings, perform configuration checks and reload, or divert traffic back to the pre-transition server. If the database structure has changed, simply reverting the PHP version may not restore functionality, so backup and data restoration plans should be used together.

Be cautious with external repositories and full upgrades

The previous method in this article added ppa:ondrej/php and ran apt-get upgrade. Whether external repositories currently support Ubuntu 18.04 and the desired PHP version is determined by the provider, and simply adding a repository does not guarantee security maintenance. apt-get upgrade affects not only PHP but also other packages that can be upgraded.

Before adding or removing repositories on a production server, review the package sources, dependencies that may change, and recovery methods. You should also check how the web server handles PHP separately, as activating only a different version of the Apache module while leaving the old PHP module as is can cause configuration conflicts.