Debian and Ubuntu users pulling from DEB.SURY.ORG received a coordinated batch of PHP updates across all active branches, led by PHP 8.4.24 and the development release 8.5.9. The July 30 patch cycle addresses high-severity vulnerabilities including a BCMath out-of-bounds write and a PostgreSQL SQL injection via pg_query(), alongside significant opcache stability fixes for the JIT. This three-week gap from the previous release indicates an emergency response to newly disclosed critical CVEs, prompting SURY to push security-only updates to both current stable and end-of-life approaching branches. Operators should upgrade immediately via apt-get update and verify GPG signatures, though 8.5 users are advised to test carefully due to the heavy changes to the tracing JIT and default OpCache behavior.

PHP 8.4.24 and 8.5.9 land on DEB.SURY.ORG, patching critical CVEs across four branches

Debian and Ubuntu users tracking PHP via DEB.SURY.ORG just received a coordinated batch of security updates. PHP 8.4.24 and 8.5.9 landed alongside 8.2.33 and 8.3.33, addressing multiple high-severity vulnerabilities and a handful of nasty JIT bugs. The jump to 8.4.24 is the heaviest of the group, bringing more than five CVEs plus a massive list of extension fixes.

The headline vulnerabilities are the BCMath out-of-bounds write in bccomp() and a PostgreSQL SQL injection via pg_query(). Both are rated high severity. The PGSQL issue stems from PHP passing strings directly to PostgreSQL's escape syntax, which opens the door for E'...' backslash breakouts. If your app routes user input straight to a database without parameterization, this is exactly the kind of flaw that gets flagged by scanners.

The other two CVEs share fixes across the current stable branches:

• CVE-2026-9672 upgrades the GD library to the latest upstream release.
• CVE-2026-7260 patches a Phar crash triggered by recursive symlinks.
• CVE-2026-17544 addresses the BCMath overflow that could potentially allow code execution via crafted arbitrary-precision math input.

DEB.SURY.ORG moves fast. Ondřej Surý's repository typically ships upstream security patches within hours of announcement, which means production servers relying on it are usually patched well before Debian or Ubuntu official repos catch up.

Why two releases in three weeks?

The previous batch dropped on July 2. This one lands on July 30. Three weeks is a tight turnaround for a maintenance release, especially when the last one was only about three weeks old. The pattern suggests new high-severity vulnerabilities were disclosed shortly after the July rollout, triggering an emergency second cycle. The BCMath and PGSQL fixes were almost certainly the catalyst.

PHP 8.5.9 picked up the same four CVEs, but the real headline there is the opcache and JIT stability work. The tracing JIT had dispatch bugs on megamorphic calls, a SIGSEGV risk on dynamic calls, and infinite recursion issues in preloaded traits. If you're running 8.5 in production, you'll want to test this build carefully. The branch introduces the pipe operator, #[NoDiscard], and default OpCache, so a stable JIT matters more than usual.

8.2 and 8.3: security-only, for now

PHP 8.3.33 is the current stable branch, though this release is strictly security. It shares the GD, PGSQL, and Phar fixes with 8.4.24, plus a minor Date extension leak fix. PHP 8.2.33 carries the same trio of CVEs. This is likely the final or near-final security push before 8.2 reaches end-of-life. If your infrastructure is still pinned to 8.2, the clock is ticking harder than usual. There's no feature upside to staying, only risk.

How to update

If you're already pulling from SURY's repo, the upgrade path is straightforward. Make sure the repository keyring is installed, then refresh your package lists.

apt-get install -y lsb-release apt-transport-https curl
curl -sSLo /tmp/debsuryorg-archive-keyring.deb https://packages.sury.org/debsuryorg-archive-keyring.deb
dpkg -i /tmp/debsuryorg-archive-keyring.deb
apt-get update
apt-get install php8.2 php8.3 php8.4 php8.5

Verify the install with php -v. You should see the new patch versions listed for your active branch.

Keep in mind that SURY's packages are signed, but third-party repositories always carry more trust overhead than official distro repos. Verify GPG signatures if your security policy requires it. Head to packages.sury.org/php/ to check the full package pool and architecture support if you're running non-x86 or non-standard Debian/Ubuntu releases.

Patch early. The PGSQL injection isn't the kind of CVE that waits for your maintenance window.