Guides › How to Check if PHP Is Patched on Ubuntu (Not Just the Version Number)

How to Check if PHP Is Patched on Ubuntu (Not Just the Version Number)

On Ubuntu, php -v can say 8.3.6 while your server already contains fixes that upstream PHP shipped in later 8.3.x releases. Security scanners that only compare upstream numbers will often call this “outdated”. Here is how to see the real patch status.

1. Find the source package and its exact version

dpkg-query -W -f='${Package} ${Version} ${source:Package}\n' 'php*-cli'
# example output format: php8.3-cli 8.3.6-0ubuntu0.24.04.X php8.3

The part after the hyphen (0ubuntu0.24.04.X) is Ubuntu’s revision. Each security update bumps it, even when the upstream part stays the same.

2. Find your release codename

lsb_release -cs   # e.g. noble, jammy

3. Read what was fixed

apt changelog php8.3 | head -60   # lists CVE IDs per Ubuntu revision

4. Compare with the Ubuntu CVE tracker

Open https://ubuntu.com/security/cves?package=php8.3. For each CVE, Ubuntu shows a status per release: released (with the fixed package version), needed/deferred (not fixed yet), not-affected or DNE. You are patched for a CVE when your installed version is greater than or equal to the fixed version, using Debian version ordering (dpkg --compare-versions A ge B).

dpkg --compare-versions "$(dpkg-query -W -f='${Version}' php8.3-cli)" ge "<fixed version from tracker>" && echo patched

5. Install pending security updates

sudo apt update && apt list --upgradable 2>/dev/null | grep php

PHPSafeCheck automates steps 4–5: enter the codename, source package and version, and it checks every CVE in the Ubuntu tracker against your exact package version.

FAQ

Does php -v tell me if I am patched?

No. php -v prints the upstream version (for example 8.3.6). Ubuntu keeps that number while adding security fixes, so the distro package version is what matters.

Where do I see which CVEs Ubuntu fixed in PHP?

In the package changelog (apt changelog php8.3) and on the Ubuntu CVE tracker at ubuntu.com/security/cves, filtered by the php source package and your release.

Is my PHP safe if apt shows no updates?

Only if your security repository is enabled and the tracker has no open (needed/deferred) CVEs for your release. Some issues may still be unfixed or only fixed in Ubuntu Pro (ESM) pockets.

Check your own code and server PHP in one pass. Upload a zip or paste a file; static analysis only, code deleted after the scan.

Coming soon — get notified

Draft guide. Commands are standard Debian/Ubuntu/Composer tooling; always confirm against the official tracker pages linked above.