How are panel updates different from PHP updates?
A panel release may define a newer PHP package while existing PHP executables remain unchanged until the component is upgraded. Record the panel version, PHP version and runtime path actually used by the application separately.
| Operation | What changes? | Where to check |
|---|---|---|
| Upgrade AdaPanel | Panel application code, management interface and bundled component definitions | Settings > Updates; the running panel version |
| Upgrade PHP | The runtime used by PHP applications | Software Store > Server Components; PHP version and an actual website response |
| Check for updates | Finds new releases; does not by itself prove installation | Server Tools > Automation; checking and automatic installation preferences |
Why can an update be available but not installed?
AdaPanel separates daily component version checks from automatic installation. When checking is enabled and automatic installation is disabled, a detected update remains pending. Read the existing preferences before changing them; updating one component does not require enabling automatic installation across the server.
A failed check, an unsupported version check and a pending update are different outcomes. A component whose version could not be retrieved because of a network or package source error should not be considered current. Assign maintenance responsibility separately for software installed outside the panel.
What should you prepare before updating PHP on Windows IIS?
Do not copy old custom extension DLLs into a new runtime without checking compatibility. The PHP branch, x64/x86 architecture, NTS/TS variant and extension build environment must match. Check the extensions your application requires after installation.
- Inventory IIS sites using PHP, their FastCGI executable paths, PHP branches and required extensions.
- Keep recovery copies of the PHP runtime directory, php.ini, custom extensions, IIS configuration and application data. Verify that the backups can be read.
- Review the target release’s security notes and application compatibility. Applying a patch within a PHP branch and migrating to another branch are separate decisions.
- Choose a maintenance window. Restarting PHP workers can affect requests already in progress.
What is the update workflow in AdaPanel?
AdaPanel 0.8.118 requires the version measured after automatic component installation to reach the detected target before counting the update as successful. This check does not mean that every function of your web application has been tested.
- Open Settings > Updates and read the official AdaPanel release notes; download and install a panel update when needed.
- After the panel restarts, check its running version.
- In Software Store > Server Components, check versions and compare the installed and available versions in the PHP row.
- Once backups and compatibility are confirmed, start the PHP update and read the outcome and any error details.
- Complete the actual runtime checks below instead of relying only on a success message.
How do you verify that the PHP update is actually working?
Keep diagnostic endpoints access controlled; do not leave full phpinfo output publicly accessible. With multiple PHP installations, the default php.exe on the command line may be different. Use the correct IIS mapping as the reference.
If a check fails, record the cause and follow the recovery plan. Returning to an old version can also remove the security fix; assess access restrictions and a new remediation plan together.
| Check | Expected evidence |
|---|---|
| Version on disk | PHP executables in the directory used by IIS report the target version |
| Actual HTTP request | The relevant IIS site responds using the new PHP version rather than another installation |
| Extensions and configuration | Required extensions load and php.ini plus site-specific settings are preserved |
| Application functions | Login, database access, uploads and any PHP-based webmail functions work |
| Logs | No new FastCGI, extension loading or application failures appear |
Where can you identify the correct security patch version?
Official PHP advisories identify affected and fixed releases; AdaPanel release notes describe panel changes. The 21 October 2026 advisory lists PHP 8.3.36 as the fix in the 8.3 branch for CVE-2026-109618 and CVE-2026-109619. Recheck current advisories when applying a later update.
Website HTTPS certificates, mail service TLS certificates and PHP runtime security patches require separate checks. Success in one area does not prove that the others are complete. Investigate certificate renewal errors separately from component version checking errors.
Frequently asked questions
Does updating AdaPanel also update PHP?
Not by itself. The panel application and PHP runtime are updated separately. Check PHP in Software Store > Server Components and apply the required runtime update.
Must I enable all automatic updates to update PHP?
No. Daily checks and automatic installation are separate preferences. After checking backups and compatibility, you can manually update only the PHP component.
Can a PHP update affect running websites?
Restarting PHP workers can affect requests in progress. Plan a maintenance window and verify each PHP application’s critical functions afterward.
Is seeing the new PHP version on the command line enough?
No. The PHP path on the command line may differ from the IIS site’s FastCGI path. Also verify an actual HTTP request to that site and the runtime path it uses.
Do I need to move from PHP 8.3 to 8.4 or 8.5 for a security patch?
You do not need to change branches when a suitable security fix is available in your existing branch. Select the fixed version identified by the official advisory and evaluate branch migration separately for application compatibility.