# Update PHP with apt on Debian and Ubuntu

By PHP Patch Assurance · Last updated: 2026-10-25

On Debian and Ubuntu, PHP usually arrives as system packages, so updating it means upgrading those packages with apt and restarting the service that runs PHP. The risk is not the upgrade itself but the missing rollback: apt has no undo button, so a snapshot of the server before the upgrade is the rollback plan.

## Check the version and the SAPI

Run `php -v` for the CLI version, and check which SAPI the web server uses — PHP-FPM or mod_php — because that decides what you restart. The CLI version and the web version can differ, so confirm the web one (see the [version-check guide](/guides/check-php-version)) rather than assuming they match.

## Snapshot first

Take a snapshot of the server before upgrading. apt can install an older package again if it is still in the repository, but a snapshot restore is the reliable way back, and it is the only clean way back if the upgrade touches configuration. No snapshot, no safe upgrade.

## Upgrade the PHP packages

Refresh the package lists, then upgrade only the PHP packages for your branch — for example `sudo apt update` followed by `sudo apt install --only-upgrade php8.3*`. Upgrading everything at once mixes a PHP patch with unrelated changes and makes a failure harder to attribute.

## Restart the right service

Restart the service that runs PHP: `sudo systemctl restart php8.3-fpm` for PHP-FPM, or `sudo systemctl restart apache2` for mod_php. The new packages do nothing until the running workers pick them up, and a missed restart is the most common reason a patch looks applied but is not live.

## Verify, then keep the snapshot

Confirm `php -v`, the key pages, and the error log — the full list is in the [health-check guide](/guides/php-health-checks). Keep the snapshot until the new version has run clean for several days; only then is the upgrade truly finished.

## Frequently asked questions

### Which service do I restart after an apt PHP upgrade?

PHP-FPM: the php-fpm service for your branch. mod_php: Apache itself, because PHP runs inside Apache's processes. Restarting the wrong one leaves the old version serving.

### Why a snapshot first?

Because apt has no undo. If the upgrade breaks the application or a configuration file, the snapshot is the way back to a known-good state in minutes instead of hours of repair.

### What if apt offers a new major version?

Do not jump branches unattended. A move such as 8.3 to 8.4 can remove functions and change behavior. Patch within your branch first, then plan the branch upgrade as its own tested change.