Linux distribution

A Linux distribution, such as Debian or Ubuntu, is a ready-made package of the operating system many servers run. It often decides which PHP version you get. If you run your own server, the distribution decides which PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it. versions you can install easily and how security fixes reach you.

What is a Linux distribution?

A distribution is a complete operating system package that often ships its own patched PHP builds.

Linux itself is only the core of an operating system. A distribution adds everything around it: the package manager, the web serverA web server is the program, such as Apache, Nginx or LiteSpeed, that answers when a visitor opens your site and sends back the page and files., the database, PHP and thousands of other programs. Debian and Ubuntu are common choices for web servers, and there are others from the Red Hat family. Each distribution release is supported for a defined period.

For PHP, the important thing is that the distribution builds its own packages. A release comes with a specific PHP branch and keeps that branch for its entire life. The distribution team applies security fixes to its own packages, often by taking the fix from newer PHP releases and adapting it, see backportA backport takes a fix made for a newer version of software and applies it to an older version, so the old one gets the fix without a full upgrade..

Versions and patch levels

Because of this, the version number of a distribution package can be misleading. The PHP version may look old while the package contains later security fixes. The reverse also happens: a package can look current while the distribution has stopped supporting the release.

What this means for your site

If your host manages the server, the distribution is their concern, but it still shapes what you are offered. A host that offers only the PHP branch of its distribution cannot give you a newer branch without changing the operating system or adding an extra package source.

On a VPSA VPS (virtual private server) is your own virtual computer inside a bigger shared machine. You get more control than on shared hosting, and more to manage., you are the one who decides. Nobody else will install updates unless you or your host arranged it. Two clocks run at the same time: the support of the PHP branch and the support of the distribution release. When the distribution release reaches end of lifeEnd of life (EOL) means the makers have stopped looking after a version of software. It still works, but it no longer gets updates, not even security fixes., security updates for everything on it stop, including PHP, even if the PHP branch itself is still supported by the PHP project.

How to check your setup

With shell access, read /etc/os-release to see the distribution and release, and run php -v to see the PHP version. Check the support period of that release on the distribution’s own website. Compare the PHP branch with the dates on php.net, and look at the package changelog for fixed CVEA CVE is a public ID number for one known security weakness in software, such as CVE-2026-109618, so everyone talks about the same problem. IDs.

Without shell access, ask your host three questions: which distribution release, which PHP branch, and until when it gets security updates.

When to act

Plan the move when the distribution release or the PHP branch has less than a year of support left, whichever comes first. Our PHP upgrade service can bring your site to a supported PHP versionA PHP version is a numbered edition of PHP, like 8.3. Each edition is looked after for a limited time, then gets security fixes only, then nothing., and when the server itself is the problem, a PHP migration service moves the site to a current stack.