Skip to main content

PHP 7.3 Security Updates for Debian 10

Everpatch PHP keeps PHP 7.3 security-patched on Debian 10, with fixes Debian only ships through paid Extended LTS.

Signed amd64 DEB packages, drop-in compatible with Surý's PPA builds. Package names stay the same; apt upgrade replaces them in place.

PHP2Shell fixed from 7.3.33-35+gps1. How to apply it · Check your server

The gap

Debian 10 left LTS in June 2024. Its PHP 7.3 security fixes since then ship only through paid Extended LTS, and Surý's repository does not build for Debian 10 at all.

PHP 7.3 itself has been end of life upstream since December 2021. Everpatch PHP 7.3 for Debian 10 carries the security fixes released since then, built and tested on Debian 10, signed, and served from extras.getpagespeed.com.

Install

Upgrade the installed PHP 7.3 in place

wget https://extras.getpagespeed.com/release-latest.deb
sudo apt install ./release-latest.deb
sudo apt update
sudo apt upgrade 'php7.3-*'
sudo systemctl restart php7.3-fpm

Package names stay the same (php7.3-*), so the upgrade replaces the installed stock or Surý PPA packages in place and keeps your configuration in /etc/php/7.3/. On a fresh host, swap upgrade for install php7.3-fpm plus the extensions you need.

Running Apache mod_php? Upgrade libapache2-mod-php7.3 as well and restart apache2 instead of PHP-FPM. Afterwards php -v prints Built by GetPageSpeed LLC.

Packages are amd64 and are tested on the target release itself: fresh installs, in-place upgrades from the original packages, and real requests through both PHP-FPM and mod_php.

Free for personal use. Running it for a business?

Patching EOL PHP is ongoing work: every new PHP CVE has to be ported to branches upstream abandoned years ago, then built and tested on Debian 10. Commercial production use requires GetPageSpeed Ultra or GetPageSpeed Fleet: either one funds that work and keeps your production servers covered for the next one, together with the full GetPageSpeed repository. Ultra covers up to 10 servers running your own services; Fleet is the plan for servers that host client websites, or for more than 10 servers. 250+ employees or $10M+ revenue, or need a contractual SLA and invoice/PO? That is Enterprise.

Ultra, $500/year Fleet, from $800/year Contact us about Enterprise

Security fixes in this package

Debian 10 never received a maintained PHP 7.3 past its final upstream release. Everpatch ships 7.3.33-35+gps1, and its changelog names 38 CVE fixes since then.

Fixed in Everpatch PHP 7.3 for Debian 10
CVE-2012-1823, CVE-2022-31625, CVE-2022-31626, CVE-2022-31628, CVE-2022-31629, CVE-2022-31631, CVE-2022-37454, CVE-2023-0567, CVE-2023-0568, CVE-2023-0662, CVE-2023-3823, CVE-2023-3824, CVE-2024-1874, CVE-2024-2756, CVE-2024-3096, CVE-2024-4577, CVE-2024-5458, CVE-2024-8925, CVE-2024-8926, CVE-2024-8927, CVE-2024-8929, CVE-2024-8932, CVE-2024-11233, CVE-2024-11234, CVE-2024-11236, CVE-2025-14177, CVE-2025-14178, CVE-2025-14180, CVE-2026-6722, CVE-2026-6735, CVE-2026-7260, CVE-2026-7261, CVE-2026-7262, CVE-2026-7568, CVE-2026-9672, CVE-2026-17543, CVE-2026-109618, CVE-2026-109619

Packages are drop-in compatible with Surý's PPA builds and are signed and served from extras.getpagespeed.com. The full story, with version checks for every supported release, is in Everpatch PHP for Ubuntu and Debian.

Frequently asked questions

Is PHP 7.3 on Debian 10 patched for PHP2Shell?

Yes. Everpatch PHP 7.3 carries the backported PHP2Shell fix from 7.3.33-35+gps1 onward. The PHP version number does not change, so check the package release rather than php -v, or paste your package list into the PHP2Shell checker. The full walkthrough is in our PHP2Shell guide.

Is PHP 7.3 still safe to run on Debian 10?

With this package, the publicly known PHP CVEs listed below are fixed. Upstream still calls PHP 7.3 end of life, and so do we: plan your upgrade on your own schedule. Everpatch exists so a CVE disclosure does not set that schedule for you.

Will this replace my existing PHP packages?

Yes, in place. The packages keep the php7.3-* names used by Debian 10 and Surý's PPA, with higher version numbers, so apt upgrade swaps them and keeps your configuration. Check the result with dpkg -l php7.3-cli.

Does this cover the rest of Debian 10?

No. Everpatch covers the PHP layer only: the php7.3-* packages. The rest of Debian 10 stays with your distribution, so plan the OS upgrade separately. Everpatch keeps PHP from being the reason it has to happen this week.

Do I need a subscription?

Not for personal, development or evaluation use: the PHP packages install from the public GetPageSpeed repository with no signup. Commercial production use requires a subscription under the repository terms: GetPageSpeed Ultra ($500/year) for up to 10 servers running your own services, or GetPageSpeed Fleet (from $800/year) for servers that host client websites or fleets larger than 10. Either one funds these backports and keeps your servers covered for the next EOL PHP CVE. Organizations with 250+ employees or $10M+ revenue, or anyone needing a contractual SLA and invoice/PO procurement, should contact us about Enterprise. To license servers without registering IP addresses, place your license file at /etc/getpagespeed/license.jwt.