PHP patch lag
How long do PHP security fixes take to reach your server?
When PHP ships a security fix, your server only gets it once your package source ships it: Ubuntu, Debian, Ondřej Surý's packages, Docker, or your hosting panel. This page measures that gap for every PHP security release, updated hourly. The data and the method are open source in greenscript/php-patch-lag.
Last updated (newest data point). Data refreshed hourly.
Latest security release
Critical · CVSS 9.2- Release date
- Patched versions
-
8.2.35 (8.2)
8.3.36 (8.3)
8.4.27 (8.4)
8.5.12 (8.5)
Delay until every branch or CVE is fixed, by channel
Time from the upstream disclosure to the fix being available. Sorted fastest first.
* Polled channel: it publishes no timestamps, so the time is when our check first saw the fix. Channels without timestamps are checked hourly, so the time can be up to an hour late.
All releases
One row per PHP security release, newest first. Each cell is the delay until every branch or CVE was fixed. Hover a cell for the first-fix delay and the exact UTC time.
| Release | Severity | Versions | Ubuntu | Debian | Ondřej (Ubuntu PPA) | Docker | ServerPilot | ||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| noble | jammy | trixie | bookworm | noble | jammy | official image | noble | jammy | |||
| 2026-10-21 | Critical · CVSS 9.2 | 8.2.35 · 8.3.36 · 8.4.27 · 8.5.12 | 22 min | 22 min | 11 min | 38 min | 4 h 27 min | 4 h 27 min | 1 h 43 min | 6 h 16 min* | 6 h 16 min* |
| 2026-09-24 | High · CVSS 7.5 | 8.2.34 · 8.3.35 · 8.4.26 · 8.5.11 | 25 days | 25 days | 1.4 days | 11 days | 21 h 21 min | 21 h 21 min | 1.3 days | — | — |
| 2026-07-30 | High · CVSS 5.5 | 8.2.33 · 8.3.33 · 8.4.24 · 8.5.9 | 42 days | 42 days | 1.4 days | 12 days | 6 h 57 min | 6 h 25 min | 11 h 23 min | — | — |
| 2026-07-02 | Medium · CVSS 4.8 | 8.2.32 · 8.3.32 · 8.4.23 · 8.5.8 | 18 days | 18 days | 1.8 days | 1.9 days | 22 h 40 min | 2.6 days | 3 h 28 min | — | — |
| 2026-05-07 | High · CVSS 9.4 | 8.2.31 · 8.3.31 · 8.4.21 · 8.5.6 | 21 days† | 21 days | 1.2 days | 1.2 days | 9 h 37 min | 8 h 1 min | 3 h 38 min | — | — |
| 2025-12-18 | Medium · CVSS 6.5 | 8.1.34 · 8.2.30 · 8.3.29 · 8.4.16 · 8.5.1 | 25 days | 25 days | 2.8 days | 74 days | 9 h 46 min | 9 h 19 min | 1.3 days | — | — |
— Not observed (no data for that channel and release). * Polled channel (no timestamps; checked hourly, so up to an hour late). † Not all fixed yet: the delay covers what is fixed so far.
How to read this
- First fix vs all fixed. First fix is the earliest moment any fixed build or advisory existed for the release. All fixed is when every patched branch (or every affected CVE) was covered. The page shows all fixed; first fix is in each cell's tooltip.
- Severity matters. Distributions prioritize by severity, so moderate releases take longer and are not comparable to critical ones. Read each delay next to its severity.
- Ubuntu and Debian backport. They apply fixes to the older PHP version they ship (for example 8.1 on jammy), so version numbers cannot be compared with upstream. Fixes are tracked per CVE, and the delay is measured to the advisory (USN, DSA or DLA).
- Polled channels. ServerPilot publishes no timestamps. We record when our check first sees the fix. Channels without timestamps are checked hourly, so the time can be up to an hour late (the 2026-10-21 ServerPilot entry was observed every 5 minutes).
- Docker. The Docker time is when the update was merged into the official images manifest. Images are built and pushed shortly after, which is not measured.
Found a mistake or want a channel added? Open an issue.
What to do if you run WordPress
Check which PHP version your site runs: Tools → Site Health → Info → Server, or PressBot's Site Check, which flags PHP that is behind or no longer supported. To see what the hours between a fix and your patch look like in practice, read what we did in the six hours between the fix and our patch.
PressBot is a free plugin: wordpress.org/plugins/greenscript-pressbot.