Installing PHP 7.4 to 8.6 with Sury on Debian and Ubuntu

When an application demands PHP 7.4 and the server runs Debian 13 with 8.4, Debian's own repositories offer no way down. Ondřej Surý's repository fills that gap: it provides PHP 5.6 through 8.6 side by side, for Debian and Ubuntu alike, built by the same developer who maintains PHP inside Debian.

What you take on in return is an extra package source that needs looking after. With old PHP versions, a risk comes with it that many guides stay quiet about.

Which versions are available

As of November 2026, Sury offers the same range for every supported suite:

php5.6  php7.0  php7.1  php7.2  php7.3  php7.4
php8.0  php8.1  php8.2  php8.3  php8.4  php8.5  php8.6

The supported Debian releases are currently bullseye, bookworm and trixie, the Ubuntu ones jammy, noble and resolute.

Debian: setting up the repository

First the tools needed for an HTTPS package source:

sudo apt update
sudo apt install -y apt-transport-https lsb-release ca-certificates curl

The signing key comes as a ready-made package. This is the step older guides get wrong — they push the key into the global keyring with apt-key, which has been deprecated for years:

sudo curl -sSLo /tmp/debsuryorg-archive-keyring.deb https://packages.sury.org/debsuryorg-archive-keyring.deb
sudo dpkg -i /tmp/debsuryorg-archive-keyring.deb

The package places its keys under /usr/share/keyrings/, deb.sury.org-php.gpg among them. You point the package source at exactly that path so the key applies to this repository only, not to all of them:

echo "deb [signed-by=/usr/share/keyrings/deb.sury.org-php.gpg] https://packages.sury.org/php/ $(lsb_release -sc) main" | sudo tee /etc/apt/sources.list.d/php.list
sudo apt update

$(lsb_release -sc) fills in your codename automatically — trixie, bookworm or bullseye. If apt update completes without a warning, the source is in place.

Ubuntu: setting up the repository

On Ubuntu the usual route is the same developer's PPA:

sudo apt update
sudo apt install -y software-properties-common
sudo add-apt-repository ppa:ondrej/php
sudo apt update

The PPA sets up key and source in one step. The Debian approach above works too, because Sury publishes its own suites for jammy, noble and resolute — but it is not necessary.

Installing PHP

From here you address versions directly. Package names carry the version number:

sudo apt install php8.3-fpm php8.3-cli

Plus the extensions, each with the same prefix:

sudo apt install php8.3-mysql php8.3-curl php8.3-gd php8.3-mbstring php8.3-xml php8.3-zip php8.3-intl php8.3-bcmath

Install php-mysql without a version number and the extension lands on your system's default version, which need not be the one your application runs on. Spell the version out every time.

For an old version, because an application has not moved on:

sudo apt install php7.4-fpm php7.4-cli php7.4-mysql php7.4-curl php7.4-gd php7.4-mbstring php7.4-xml

Several versions may be installed at once. Deciding which one applies where is covered in running multiple PHP versions.

Confirming the packages come from Sury

apt policy php8.3-fpm
php8.3 -v

apt policy shows which source the installed package came from. If it says packages.sury.org, the setup worked. Sury's version strings carry a suffix like +0~20261027.42+debian13~1.gbpXXXXXX, which is how you recognise its packages later.

What the third-party source costs you

The repository is run by a single person. That has worked reliably for many years, but it is a different commitment from the one the Debian security team makes.

When a Debian release reaches end of life, its suite goes with it. Sury removed buster when Debian 10 fell out of support; anyone sourcing PHP from it there has had no updates since and cannot even reach the last published build. So plan the Debian upgrade before the release runs out.

And old PHP versions stay old. Sury keeps building them, but the PHP group no longer fixes new vulnerabilities in 7.4. An application that requires it belongs on the to-do list, not in permanent service.

Removing the repository again

sudo rm /etc/apt/sources.list.d/php.list
sudo apt update

Packages installed from Sury stay in place and stop receiving updates. To return fully to Debian's own version, remove the versioned packages and install Debian's variant — after a backup, because configuration and extensions go with them.

Troubleshooting

Frequently asked questions about Sury and PHP

Is Sury safe?

The repository is run by Ondřej Surý, who also maintains PHP within Debian. It has been the usual route for non-default PHP versions for years. It remains a third-party source with a single maintainer, which is a different commitment from the Debian security team's.

Can I install PHP 7.4 on Debian 13 with it?

Yes, Sury carries 5.6 to 8.6 for trixie. PHP 7.4 has had no security fixes from the PHP group since November 2022, though. Use it only when an application truly requires it.

Does this work on Ubuntu too?

Yes. The usual route there is ppa:ondrej/php from the same developer. Sury additionally publishes its own suites for jammy, noble and resolute.

Why should I avoid apt-key?

apt-key places the key in the global keyring, where it applies to every package source. The signed-by option limits it to this one repository. apt-key has also been deprecated for years.

What happens when Sury drops my Debian release?

The suite disappears, apt update reports an error, and updates stop. That is exactly what happened when Debian 10 reached end of life. Move to a newer Debian before yours runs out.

Can I install several PHP versions at once?

Yes, and with Sury that is the normal case. The packages carry the version number in their names and do not interfere with each other. Which version applies where is controlled separately.