Wordpress Complains About PHP Version

[ash34]

Now that Wordpress complains about PHP version 8.2.29 and that the minimum recommended version of PHP is 8.3, how to update?

[JedMeister]

Hi @ash34

That occurs time to time when a PHP version becomes "end of life" (EOL). As you may already be aware - or may be obvious, that means that the PHP developers no longer provide any fixes - including security related fixes.

However the default PHP install we provide (i.e. 8.2) comes from Debian, not directly from PHP devs. Debian devs work with PHP devs and other Linux devs from distros such as Ubuntu, SUSE Linux, Red Hat Enterprise Linux, etc develop backported security fixes for the PHP 8.2 packages. The default TurnKey config will auto install these new security updates as they are released by Debian.

Our current v18.x appliances are based on Debian 12/Bookworm. So the included Debian PHP 8.2 package will receive security updates at least until June 30, 2028.

So while WordPress recommend using a version of PHP that is still supported upstream, they note on their requirements page (towards the bottom):

[...] WordPress also works with PHP 7.2.24+ [...]

They go on to mention potential security issues - but I've covered that above.

We do hope to have a new v19.x batch of appliances (based on Debian 13/Trixie) ASAP. Debian 13/Trixie includes PHP 8.4.

---

In the meantime, you have a few options:

• Stick with the Debian PHP packages & ignore the warning. The upside is that you don't need to do anything - at least for now. The downsides are:
  • the admin page warning
  • there may be (but not always) performance improvements with the newer PHP
  • some third party plugins/modules may end support for older versions of PHP at some point - FWIW more popular plugins/modules will usually support older PHP versions, but less popular and/or ones with smaller dev teams may not. That is obviously a potential issue if future plugin releases provide security fixes.
• Update PHP on your current server. The downside of that is that you will no longer automatically get PHP security updates, you will need to manually update PHP when security issues come to light.
  • FWIW we provide a PHP upgrade script - detailed below.
• Manually upgrade the base Debian OS. The downsides of that are that it's a non-trivial process that can be a bit involved and will leave you with a hybrid "TurnKey v18.x on Debian 13/Trixie" OS.

---

If you would like to upgrade PHP on your current system, then the best path is to use the updated packages from deb.sury.org. The guy that provides those packages is a trusted third party and he's also a Debian and Ubuntu developer that is involved in the "official" Debian/Ubuntu packages and is involved in developing the security patches that are applied to the older PHP packages that you are already getting.

There are instructions there on how you can do that manually update PHP. But additional steps are required to enable the new PHP version on your server.

Alternatively, we provide a tkl-upgrade-php script that can upgrade PHP and enable the newer PHP version. We plan to install that by default in future releases, but you can download and run it like this (assuming root):

wget https://raw.githubusercontent.com/turnkeylinux/common/refs/heads/18.x/overlays/php/usr/local/bin/tkl-upgrade-php
mv tkl-upgrade-php /usr/local/bin/
chmod +x /usr/local/bin/tkl-upgrade-php

Then run it:

tkl-upgrade-php

It has been tested pretty well, but as it's not yet included by default there is a chance of bugs we didn't hit in our testing. So if you have any issues, please open a new issue.

[ash34]

Thanks for this.

I tried the script to update to 8.3 and although it ran and completed in a few seconds the website was not functional after that. A reboot could not fix it.

I tried

cp -R /etc/php/8.2/* /etc/php/8.3/

Followed by a reboot but that did not solve it either. Had to rollback the server.

Unless there's a relatively easy fix I will stay with 8.2 and ignore the Wordpress warnings.

BTW...

I also notice that after the script is run the Webmin page for PHP still points to the old version but this is easily solved in the UI after clicking the configuration gear icon.

[JedMeister]

That sucks that it didn't work :( Thanks for reporting back though. Your feedback is invaluable.

It would be useful to see what the actual error was (should be some info in the apache logs) but obviously that's not an option now you've rolled back. When I get a chance I'll have a look myself.