How to install PHP 5.6 and 7.0 – 8.4 with PHP-FPM and FastCGI mode for ISPConfig 3.2 with apt on Debian 11 to 12 |

When using ISPConfig, by default, you only have the main PHP version for your distribution. This guide will take you through installing additional PHP versions (5.6, 7.0, 7.1, 7.2, 7.3, 7.4, 8.1, 8.2, 8.3 and 8.4) on a Debian server with ISPConfig.

After installing the additional versions, you can select them for use on specific websites in both PHP-FPM and FastCGI mode.

1 Preliminary Note

In this guide, you will add the SURY repository additional repository to install the PHP packages from with apt. Because other packages as OpenSSL, are updated too, the installed packages from sury.org can not simply be removed after installation. So do not remove SURY as a repository source later on.

Please note that PHP-FPM can be used on Apache and Nginx servers, while FastCGI is available only for Apache servers.

Choose Your Repository Configuration Method

Debian provides two approaches for adding the Sury PHP repository. The extrepo method handles GPG keys and repository configuration automatically, while manual configuration offers full control over repository settings.

Method	GPG Key Management	Debian Support	Steps Required	Best For
extrepo (Recommended)	Automatic	11, 12, 13	3 commands	Most users; quick setup with minimal configuration
Manual Repository	Manual download	11, 12, 13	5 commands	Scripted deployments, custom configurations, or learning APT internals

For most users, the extrepo method is recommended because it simplifies repository management and reduces manual steps. Debian’s extrepo tool maintains a curated list of external repositories with verified GPG keys, making it the safest approach for adding third-party sources.

Choose Your PHP Version for Debian

Compare Supported PHP Releases

Each PHP version targets different support lifecycles and compatibility needs. Debian’s default repositories provide stable PHP versions maintained by the Debian security team, while the Sury repository offers current releases with upstream security support.

PHP Version	Primary Focus	Performance	Best For	Trade-offs
PHP (Distro Default)	Stability with Debian security team maintenance	Varies by version; Debian 12’s PHP 8.2 includes JIT compilation and OPcache	Production servers prioritizing official Debian updates and minimal external dependencies	Version varies by release (8.4 on Debian 13, 8.2 on Debian 12, 7.4 on Debian 11)
PHP 8.5	Pipe operator, URI extension, clone with properties, array helpers	Improved JIT and continued IR-based JIT framework refinements	Projects leveraging function chaining, advanced URL handling, or needing array_first()/array_last()	Newest release; requires Sury repository on all Debian versions
PHP 8.4	Property hooks, asymmetric visibility, HTML5 DOM API	Continued JIT improvements; new IR-based JIT framework	Projects using modern OOP patterns, applications requiring array_find() and BCMath object API	Requires Sury repository on Debian 11/12; available in Debian 13 default repositories
PHP 8.3	Typed class constants, json_validate(), readonly property cloning	Mature JIT optimization with broad extension compatibility	WordPress 6.x, Laravel 11, Drupal 10 sites needing stable features with security support through December 2027	Requires Sury repository on all Debian versions; community-maintained updates

Recommendation: Choose PHP 8.3 when your applications require typed class constants, json_validate(), or readonly property cloning while benefiting from broad ecosystem compatibility. WordPress 6.x, Laravel 11, and Drupal 10 all run well on PHP 8.3 with security support through December 2027. If you need the pipe operator or array_first()/array_last() helpers, consider PHP 8.5. Alternatively, consider PHP 8.4 if you need property hooks or the new HTML5 DOM API, or choose the distro default PHP when you prefer official Debian security team maintenance.

Decide When to Use PHP 8.3

Install PHP 8.3 from the Sury repository when your application requires features unavailable in Debian’s default PHP packages, or when you need the extended security support timeline through December 2027. The Sury repository provides timely updates but operates independently from Debian’s security team, so production deployments should monitor PHP security advisories directly.

Import PHP 8.3 APT Repository on Debian

Update Debian System Before PHP 8.3 Installation

Before adding external repositories, update your existing packages to ensure dependency resolution works correctly. Run the following commands to refresh the package index and apply any pending upgrades:

sudo apt update
sudo apt upgrade

Method 1: Use extrepo (Recommended)

The extrepo tool automates external repository management by handling GPG keys and source file creation. First, install extrepo and its dependencies:

sudo apt install extrepo -y

Next, enable the Sury PHP repository:

sudo extrepo enable sury

The extrepo command creates the repository configuration at /etc/apt/sources.list.d/extrepo_sury.sources and places the GPG key at /var/lib/extrepo/keys/sury.asc. Once enabled, refresh the package index:

sudo apt update

Verify PHP 8.3 is now available from the Sury repository:

apt-cache policy php8.3

Expected output:

php8.3:
  Installed: (none)
  Candidate: 8.3.x+0~YYYYMMDD+debianXX
  Version table:
     8.3.x+0~YYYYMMDD+debianXX 500
        500 https://packages.sury.org/php [codename]/main amd64 Packages

Method 2: Manual Repository Configuration

For scripted deployments or when you need full control over repository configuration, add the Sury repository manually. First, install the required packages:

sudo apt install ca-certificates curl gnupg lsb-release -y

Download and install the Sury PHP repository GPG keyring package:

curl -sSLo /tmp/debsuryorg-archive-keyring.deb https://packages.sury.org/debsuryorg-archive-keyring.deb
sudo dpkg -i /tmp/debsuryorg-archive-keyring.deb

Next, create the repository configuration file using the modern DEB822 .sources format:

cat <<EOF | sudo tee /etc/apt/sources.list.d/php.sources
Types: deb
URIs: https://packages.sury.org/php/
Suites: $(lsb_release -cs)
Components: main
Signed-By: /usr/share/keyrings/debsuryorg-archive-keyring.gpg
EOF

Finally, refresh the package index and verify PHP 8.3 availability:

sudo apt update
apt-cache policy php8.3

Expected output:

php8.3:
  Installed: (none)
  Candidate: 8.3.x+0~YYYYMMDD+debianXX
  Version table:
     8.3.x+0~YYYYMMDD+debianXX 500
        500 https://packages.sury.org/php [codename]/main amd64 Packages