PHP 8.1 Security Updates for Ubuntu 20.04

Q: Will this replace my existing PHP packages?

Yes, in place. The packages keep the php8.1-* names used by Ubuntu 20.04 and Surý's PPA, with higher version numbers, so apt upgrade swaps them and keeps your configuration. Check the result with dpkg -l php8.1-cli.

Q: Does this cover the rest of Ubuntu 20.04?

No. Everpatch covers the PHP layer only: the php8.1-* packages. The rest of Ubuntu 20.04 stays with Canonical, so plan the OS upgrade separately. Everpatch keeps PHP from being the reason it has to happen this week.

Everpatch PHP keeps PHP 8.1 security-patched on Ubuntu 20.04, after Surý's PPA stopped building it.

Signed amd64 DEB packages, drop-in compatible with Surý's PPA builds. Package names stay the same; apt upgrade replaces them in place.

PHP2Shell fixed from 8.1.34-9+gps1. How to apply it · Check your server

The gap

Ubuntu 20.04 left standard support in May 2025. Its stock PHP 7.4 now gets security fixes only through Ubuntu Pro (ESM), and Surý's PPA, where 20.04 servers got every newer PHP, stopped building for 20.04 at the same time. Every PHP security release since then has skipped those servers.

PHP 8.1 itself has been end of life upstream since December 2025. Everpatch PHP 8.1 for Ubuntu 20.04 carries the security fixes released since then, built and tested on Ubuntu 20.04, signed, and served from extras.getpagespeed.com.

Install

Upgrade the installed PHP 8.1 in place

wget https://extras.getpagespeed.com/release-latest.deb
sudo apt install ./release-latest.deb
sudo apt update
sudo apt upgrade 'php8.1-*'
sudo systemctl restart php8.1-fpm

Package names stay the same (php8.1-*), so the upgrade replaces the installed stock or Surý PPA packages in place and keeps your configuration in /etc/php/8.1/. On a fresh host, swap upgrade for install php8.1-fpm plus the extensions you need.

Running Apache mod_php? Upgrade libapache2-mod-php8.1 as well and restart apache2 instead of PHP-FPM. Afterwards php -v prints Built by GetPageSpeed LLC.

Packages are amd64 and are tested on the target release itself: fresh installs, in-place upgrades from the original packages, and real requests through both PHP-FPM and mod_php.

Free for personal use. Running it for a business?

Patching EOL PHP is ongoing work: every new PHP CVE has to be ported to branches upstream abandoned years ago, then built and tested on Ubuntu 20.04. Commercial production use requires GetPageSpeed Ultra or GetPageSpeed Fleet: either one funds that work and keeps your production servers covered for the next one, together with the full GetPageSpeed repository. Ultra covers up to 10 servers running your own services; Fleet is the plan for servers that host client websites, or for more than 10 servers. 250+ employees or $10M+ revenue, or need a contractual SLA and invoice/PO? That is Enterprise.

Ultra, $500/year Fleet, from $800/year Contact us about Enterprise

Security fixes in this package

The last free PHP 8.1 build for Ubuntu 20.04 was 8.1.32-1. Everpatch ships 8.1.34-9+gps1, and its changelog names 24 CVE fixes since then.

Fixed in Everpatch PHP 8.1 for Ubuntu 20.04
CVE-2025-1218, CVE-2025-14177, CVE-2025-14178, CVE-2025-14179, CVE-2025-14180, CVE-2025-14181, CVE-2026-6103, CVE-2026-6722, CVE-2026-6735, CVE-2026-7258, CVE-2026-7259, CVE-2026-7261, CVE-2026-7262, CVE-2026-7568, CVE-2026-17545, CVE-2026-91765, CVE-2026-91766, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-92842, CVE-2026-93682, CVE-2026-109618, CVE-2026-109619

Packages are drop-in compatible with Surý's PPA builds and are signed and served from extras.getpagespeed.com. The full story, with version checks for every supported release, is in Everpatch PHP for Ubuntu and Debian.

Frequently asked questions

Is PHP 8.1 on Ubuntu 20.04 patched for PHP2Shell?

Yes. Everpatch PHP 8.1 carries the backported PHP2Shell fix from 8.1.34-9+gps1 onward. The PHP version number does not change, so check the package release rather than php -v, or paste your package list into the PHP2Shell checker. The full walkthrough is in our PHP2Shell guide.

Is PHP 8.1 still safe to run on Ubuntu 20.04?

With this package, the publicly known PHP CVEs listed below are fixed. Upstream still calls PHP 8.1 end of life, and so do we: plan your upgrade on your own schedule. Everpatch exists so a CVE disclosure does not set that schedule for you.

Will this replace my existing PHP packages?

Yes, in place. The packages keep the php8.1-* names used by Ubuntu 20.04 and Surý's PPA, with higher version numbers, so apt upgrade swaps them and keeps your configuration. Check the result with dpkg -l php8.1-cli.

Does this cover the rest of Ubuntu 20.04?

No. Everpatch covers the PHP layer only: the php8.1-* packages. The rest of Ubuntu 20.04 stays with Canonical, so plan the OS upgrade separately. Everpatch keeps PHP from being the reason it has to happen this week.

Do I need a subscription?

Not for personal, development or evaluation use: the PHP packages install from the public GetPageSpeed repository with no signup. Commercial production use requires a subscription under the repository terms: GetPageSpeed Ultra ($500/year) for up to 10 servers running your own services, or GetPageSpeed Fleet (from $800/year) for servers that host client websites or fleets larger than 10. Either one funds these backports and keeps your servers covered for the next EOL PHP CVE. Organizations with 250+ employees or $10M+ revenue, or anyone needing a contractual SLA and invoice/PO procurement, should contact us about Enterprise. To license servers without registering IP addresses, place your license file at /etc/getpagespeed/license.jwt.