Issue PHP TuxCare System Updates: ALT-PHP packages held back due to PHP-FPM dependency conflicts

[TorbHo]

Server operating system version

Ubuntu 24.04.5 LTS

Plesk version and microupdate number

18.0.81 Update #4

Hello everyone,

We are experiencing an issue with system package updates in Plesk on an Ubuntu 24.04 server.

Due to the PHP security vulnerability disclosed yesterday we would like to install the available security updates provided by TuxCare as soon as possible. Unfortunately, the dependency conflicts described below are currently preventing us from doing so.

Since this is a security-related matter, we would appreciate guidance on how to safely apply these updates without disrupting our hosted websites.

Under Tools & Settings → System Updates → All Packages, Plesk shows several available updates. However, when I select the packages and try to install them, Plesk reports:

All the selected packages are up-to-date.

Environment​

• OS: Ubuntu 24.04 (Noble)
• Control Panel: Plesk
• PHP packages: TuxCare ALT-PHP (PHP 7.1–8.1)
• Repository: https://repo.alt.tuxcare.com/alt-php-els/deb/ubuntu/24.04/stable

Investigation​

Running apt upgrade shows that numerous ALT-PHP packages are being held back.

A simulated distribution upgrade:

apt-get -s dist-upgrade
produces the following result:

148 upgraded, 2 newly installed,
6 to remove and 0 not upgraded.
The critical part is that APT wants to remove all installed ALT-PHP-FPM packages:

alt-php71-fpm
alt-php72-fpm
alt-php73-fpm
alt-php74-fpm
alt-php80-fpm
alt-php81-fpm

Identified dependency conflict​

For example, PHP 8.1 currently has the following package versions:

Package	Installed	Available
alt-php81	8.1.34-13	8.1.34-39
alt-php81-common	8.1.34-13	8.1.34-39
alt-php81-fpm	8.1.34-13	8.1.34-13

The installed alt-php81-fpm package has a strict dependency:

Depends: alt-php81-common (= 8.1.34-13)
However, the latest available alt-php81-common package is version 8.1.34-39.

There is no matching alt-php81-fpm version available in the configured repository.

As a result, APT cannot upgrade alt-php81-common while keeping the existing PHP-FPM package installed.

The same issue appears to affect PHP 7.1 through PHP 8.0.

Possible package naming change?​

I also noticed that PHP 5.6 uses a differently named FPM package:

alt-php56-php-fpm
Whereas PHP 7.1–8.1 use packages such as:

alt-php81-fpm
Could TuxCare have changed the naming convention or replaced the older FPM packages with packages named alt-phpXX-php-fpm?

Questions​

1. Is this a known issue with the TuxCare ALT-PHP repository on Ubuntu 24.04?
2. Have the ALT-PHP-FPM packages been renamed or replaced?
3. Is there a supported migration procedure that preserves existing PHP-FPM configurations and Plesk integration?
4. How can I safely install the available ALT-PHP security updates without removing the PHP-FPM handlers?
5. Could this dependency conflict explain why Plesk System Updates reports that all selected packages are already up to date?

I have deliberately not executed dist-upgrade, since it would remove six installed PHP-FPM packages.

Any guidance from the Plesk team or other administrators using TuxCare ALT-PHP would be greatly appreciated.

Thanks in advance!

 

[Sebahat.hadzhi]

Hi, @TorbHo . I consulted with CloudLinux about your case and they confirmed that the packages alt-phpXX-fpm were superseded by alt-phpXX-php-fpm but the old name is still listed in the repositories as the last builds, which is why apt can't match it with the current alt-phpXX-common. Installing the new ones should do the trick:

apt-get install alt-phpXX-php-fpm

 

[TorbHo]

@Sebahat.hadzhi

Thank you for your help and for checking this with CloudLinux!

I followed your recommendation and installed the new alt-phpXX-php-fpm packages for PHP 7.1 through 8.1.

The installation was successful, and apt update / apt list --upgradable now report that all packages are up to date.

I also verified the following:

• The new ALT-PHP-FPM packages are installed with matching alt-phpXX-common versions.
• Plesk still recognizes the ALT-PHP-FPM handlers, and they remain enabled.
• The running PHP-FPM master processes use the binaries under /opt/alt/phpXX/usr/sbin/php-fpm.
• None of the running ALT-PHP-FPM master processes reference a deleted or replaced binary.

So the migration appears to have worked correctly.

1. Confirmation of the security patches​

Due to the security vulnerabilities disclosed on October 21, 2026, we specifically wanted to ensure that our PHP installations are protected by the latest TuxCare security patches.

Can you or CloudLinux confirm that the currently available ALT-PHP package builds already contain the fixes for these recently disclosed vulnerabilities?

For example, we currently have these versions installed:

PHP version	Installed TuxCare package revision
PHP 7.1	7.1.33-116
PHP 7.2	7.2.34-100
PHP 7.3	7.3.33-84
PHP 7.4	7.4.33-81
PHP 8.0	8.0.30-70
PHP 8.1	8.1.34-39

Are all these builds already patched against the vulnerabilities disclosed yesterday, or are additional security updates still pending for some PHP versions?

Is there an official TuxCare/CloudLinux advisory or changelog that confirms which package revisions include the security fixes?

We would like to make sure that being fully up to date according to APT also means that the relevant security fixes have actually been applied.

2. Plesk still shows available updates under "All Packages"​

There is also one remaining issue:

Even though APT reports that all packages are up to date, Plesk still shows available package updates under Tools & Settings → System Updates → All Packages.

Running:

apt update
apt list --upgradable
returns:
All packages are up to date.

I also tried clicking Check for Updates in the Plesk interface, but unfortunately this did not resolve the issue. The updates are still listed.

Previously, attempting to install these updates through Plesk resulted in the message:

All the selected packages are up-to-date.
Could this be caused by stale package information in Plesk's System Updates cache, possibly related to the renamed ALT-PHP-FPM packages?

Is there a recommended way to force Plesk to rebuild or refresh its system package update information?

I also tried plesk sbin pum --check. Is there another recommended procedure?

We would appreciate clarification on both points: confirmation that the installed TuxCare builds contain the relevant security fixes, and a way to synchronize Plesk's update display with the actual APT package status.

Thanks again for your assistance!