Run several PHP versions on one server with the Sury repo

Distribution PHP is one version per release. That is fine until one customer needs an old application on PHP 8.2 while a new project wants PHP 8.5. The usual answer on Debian and Ubuntu is the repository run by Ondrej Sury, a Debian developer who has packaged PHP for Debian since PHP 5 according to deb.sury.org. This guide installs several versions side by side, gives each site its own pool and shows how to keep the whole thing safe. It was written on 30 October 2026.

Which repository for which release

The Sury packages come in two forms, and the choice depends on your release.

This is a change worth knowing about. The PPA page on Launchpad now says the PPA is being merged into packages.sury.org, and that for earlier Ubuntu releases a simple way to migrate will be provided later. On 30 October 2026 the PPA still serves jammy and noble. If you write automation today, make it switch on the release name, so that moving later is one change.

Add the repository

On Ubuntu 22.04 or 24.04:

sudo apt-get update
sudo apt-get install -y software-properties-common
sudo add-apt-repository -y ppa:ondrej/php
sudo apt-get update

On Debian and on Ubuntu 26.04 the repository publishes a setup script at packages.sury.org/php/README.txt. It does this, which you can run by hand:

sudo apt-get update
sudo apt-get -y install lsb-release ca-certificates curl
sudo curl -sSLo /tmp/debsuryorg-archive-keyring.deb https://packages.sury.org/debsuryorg-archive-keyring.deb
sudo dpkg -i /tmp/debsuryorg-archive-keyring.deb
sudo sh -c 'echo "deb [signed-by=/usr/share/keyrings/debsuryorg-archive-keyring.gpg] https://packages.sury.org/php/ $(lsb_release -sc) main" > /etc/apt/sources.list.d/php.list'
sudo apt-get update

The key is pinned with signed-by, so it is trusted for this repository only. Read the script before you run it as root, as you should with any third party repository: it replaces part of your base system's PHP with another packager's build.

Install the versions you need

Each version is a set of packages named after it: php8.3-fpm, php8.4-fpm and so on. Install the FPM service, the CLI and the extensions a typical application needs:

sudo apt-get install -y php8.3-fpm php8.3-cli php8.3-mysql php8.3-curl php8.3-mbstring php8.3-xml php8.3-zip php8.3-gd php8.3-intl php8.3-bcmath
sudo apt-get install -y php8.5-fpm php8.5-cli php8.5-mysql php8.5-curl php8.5-mbstring php8.5-xml php8.5-zip php8.5-gd php8.5-intl php8.5-bcmath

Replace the version number to add 8.2 or 8.4. Every version gets its own configuration under /etc/php/<version>/, its own service (php8.3-fpm, php8.5-fpm) and its own socket in /run/php/. Nothing is shared, which is why they can run together. Check what you have:

systemctl list-units 'php*-fpm*'
ls /run/php/

One FPM pool per site

A pool is a group of PHP workers that run as one user with its own limits. Giving each site its own pool, as its own Linux user, means one site cannot read the files of another and one runaway site cannot take all the workers. Create /etc/php/8.5/fpm/pool.d/shop.conf:

[shop]
user = shop
group = shop
listen = /run/php/shop.sock
listen.owner = www-data
listen.group = www-data
pm = ondemand
pm.max_children = 8
pm.process_idle_timeout = 20s
php_admin_value[open_basedir] = /home/shop/:/tmp/

Then test and reload. The test command carries the version number in its name:

sudo php-fpm8.5 -t
sudo systemctl reload php8.5-fpm

In Nginx, send that site's PHP requests to the pool's socket with fastcgi_pass unix:/run/php/shop.sock;. A second site on PHP 8.3 gets a pool file under /etc/php/8.3/fpm/pool.d/ and its own socket. Remove the default www.conf pool from versions you do not use for the default site, otherwise it keeps workers you never asked for. The same idea for a whole server is explained in hosting many websites on one server.

Extensions and the command line

Install extensions as packages when one exists, such as php8.5-redis or php8.5-imagick. A packaged extension is built for exactly that version and updates with it. If you must build one with PECL, install php8.5-dev first, and expect to rebuild it for every version. When the PECL site is unreachable, the packaged extension is the fallback that does not need it, which is another reason to prefer packages.

The php command in a terminal and in cron is separate from the FPM services. Choose its default with:

sudo update-alternatives --config php

For one command, call the version directly: php8.3 artisan migrate. Scripts that matter should always name the version, so an upgrade of the default does not change their behaviour. For Composer, run php8.3 /usr/local/bin/composer install so that it resolves packages for the right version.

Retire old versions on time

The repository still carries versions as old as PHP 5.6, and that is a trap, not a feature. The supported versions page on php.net shows, as of 30 October 2026:

Versions older than 8.2 are no longer on the list, so they get no security fixes. PHP 8.2 stops receiving them in two months. Make a short list of which site runs which version, and move each site off a version before its security date. Moving a site is cheap with pools: change its listen socket in the web server block, reload, and the old pool can be removed.

When the repository is down

Third party repositories go down, or change as the PPA merge shows. Installed packages keep working, so a repository outage never takes a running site off line. To stay safe, hold the versions you tested with sudo apt-mark hold php8.5-fpm php8.5-cli, and do upgrades on a schedule, in daylight, not inside a deploy. Keep a copy of the .deb files you install (apt-get download) if you need to rebuild a server on a day the repository is unreachable.

Where a panel helps

Everything above is a good afternoon of work for one server and a lot of repeated work for twenty. RespireCloud gives each hosting account its own PHP-FPM master per PHP version, running as that user, so the pool and user rules above are applied by default. See websites and hosting. If you only have one or two sites, the commands in this post are all you need.