Guides › PHP CVE Backports Explained: Why “Outdated” PHP May Be Secure
PHP CVE Backports Explained: Why “Outdated” PHP May Be Secure
A common false alarm: a scanner sees PHP 8.3.6 on Ubuntu, looks up advisories that say “fixed in a later 8.3.x”, and reports the server as vulnerable. Often it is not — the fix has been backported.
How a distro version string works
Debian-family versions look like [epoch:]upstream-revision. The upstream part (8.3.6) is frozen for the life of the release; the revision (0ubuntu0.24.04.N or 1~deb13uN) grows with each patched build. Comparing two versions needs dpkg ordering rules (for example ~ sorts before anything, even an empty string), not a simple numeric compare.
Why upstream version checks mislead
- Upstream advisories describe upstream releases (“before 8.3.x”).
- Distros fix the same bug in their own build and publish their own fixed package version per release.
- So the correct question is: is my installed package version ≥ the distro’s fixed version for this CVE on my release?
Where the truth lives
- Ubuntu:
ubuntu.com/security/cves(also a public JSON API) andapt changelog. - Debian:
security-tracker.debian.org/tracker/source-package/php8.xand its JSON export.
When upstream versions do matter
If you built PHP from source, use a PPA/third-party repo, a Docker image based on official php images, or a hosting control panel build, backport data from Debian/Ubuntu does not apply — compare against upstream releases and the upstream branch support status instead.
PHPSafeCheck does this comparison for Ubuntu and Debian packages and shows, per CVE, the distro’s fixed version and whether your build includes it.
FAQ
What is a backport?
Taking the fix for a vulnerability from a newer release and applying it to the older version a distribution ships, without upgrading to the new upstream version.
Why do distributions do this?
Stable releases promise no behaviour changes. Backporting only the security fix keeps applications working while closing the hole.
How do I tell a backported build apart?
Look at the full package version, not the upstream number: e.g. a Debian string like 8.4.x-1~deb13uN or an Ubuntu string like 8.3.6-0ubuntu0.24.04.N. The trailing revision increases with each security update.
Can backports lag behind upstream?
Yes. Some CVEs are deferred, judged low priority, or only fixed in extended-support pockets. The distro tracker shows the status for each CVE and release.
Check your own code and server PHP in one pass. Upload a zip or paste a file; static analysis only, code deleted after the scan.
Coming soon — get notifiedDraft guide. Commands are standard Debian/Ubuntu/Composer tooling; always confirm against the official tracker pages linked above.