In short: Compiling PHP means downloading the official source package from php.net, using ./configure to define the desired interfaces and extensions, building with make, checking with make test and then installing. This gives full control over version and scope. The price: you are responsible for every security update yourself, as most recently with PHP2Shell, when rebuilding and restarting all processes was required.
When custom PHP builds make sense
Most servers obtain PHP from a package source: from the Linux distribution, a third-party repository or a container image. For normal operation this is usually the best choice, because security fixes are delivered automatically.
Custom builds still have their place:
| Situation | Package source | Custom build |
|---|---|---|
| Normal web server | usually better | rarely necessary |
| Version or option not in a trustworthy source | not available | sensible |
| Debugging PHP itself, debug build | limited | sensible |
| Minimal feature set for special systems | limited | sensible |
| Security updates | come with the source | your own task |
Anyone who decides on custom builds needs a fixed process for updates, otherwise the advantage turns into a risk.
Prerequisites
According to the manual, GNU make and a C compiler are required; since PHP 8.4 the compiler must support C11. Anyone building from the Git repository instead of a release package additionally needs autoconf (2.68 or later), re2c (1.0.3 or later for PHP 8.3 and newer) and bison (3.0.0 or later). For Ubuntu, the README in the source code gives this starting point:
sudo apt install -y pkg-config build-essential autoconf bison re2c libxml2-dev libsqlite3-dev
For each additional extension, the matching development packages are added, for example for OpenSSL or libsodium.
Downloading the source and verifying authenticity
A self-built PHP is only as trustworthy as its source code. php.net offers every package with an SHA-256 checksum and a GPG signature; the release managers' keys are on the download page and on the page with the GPG keys.
curl -O https://www.php.net/distributions/php-8.4.27.tar.xz
curl -O https://www.php.net/distributions/php-8.4.27.tar.xz.asc
sha256sum php-8.4.27.tar.xz # compare with the value on php.net
gpg --verify php-8.4.27.tar.xz.asc php-8.4.27.tar.xz
Only when the checksum and signature match do you continue.
Compiling PHP: configure, make, test
The process has four steps:
- Configure:
./configurewith the desired options. When building from Git, run./buildconffirst. - Build:
make -j"$(nproc)"; according to the README, the number of jobs sensibly corresponds to the number of processor cores. - Test:
make TEST_PHP_ARGS=-j4 testruns PHP's test suite. - Install:
make install, depending on the target directory with root privileges.
An example of a PHP-FPM build with its own target directory:
tar xf php-8.4.27.tar.xz && cd php-8.4.27
./configure --prefix=/opt/php-8.4 \
--with-config-file-path=/opt/php-8.4/etc \
--enable-fpm --with-fpm-user=www-data --with-fpm-group=www-data --with-fpm-systemd \
--with-openssl --with-sodium \
--disable-cgi
make -j"$(nproc)"
make TEST_PHP_ARGS=-j4 test
sudo make install
/opt/php-8.4/bin/php -v
The most important options at a glance:
| Option | Effect |
|---|---|
--enable-fpm |
builds PHP-FPM; together with --with-fpm-user, --with-fpm-group, --with-fpm-systemd |
--with-config-file-path |
directory in which PHP looks for php.ini |
--with-openssl |
OpenSSL support; since PHP 7.4 the path is found via pkg-config |
--with-sodium |
modern cryptography with libsodium |
--disable-cgi |
skips the CGI variant if it is not needed |
--enable-debug |
debug symbols, recommended by the README for development, not for production |
--enable-zts |
thread safety for operating modes with threads |
With --prefix, several self-built versions can be installed side by side, for example under /opt/php-8.3 and /opt/php-8.4. This eases switchovers but demands discipline: every installed version is software in its own right that must be rebuilt with every security release, even if no website is currently using it. Builds that are no longer needed should be removed completely. Which options an existing build has is shown by php -i in the “Configure Command” line; it is the best template for the next rebuild.
A note on OPcache: since PHP 8.5, according to the accepted RFC, OPcache is compiled in permanently. In older versions it is built as an extension and loaded via zend_extension. What extensions and interfaces are is explained in Understanding PHP extensions and SAPI explained.
Custom builds and security: the duties after PHP2Shell
Self-compiled PHP has a genuine security advantage: you build only what you need. Every extension not built and every operating mode not built is code that cannot contain a flaw. A build without CGI, with few extensions and clear paths is easy to oversee.
Set against this is a hard duty. For PHP2Shell, distributions delivered backports in some cases on 21 October 2026; anyone who builds themselves gets nothing automatically. Concretely, that meant:
- Download and verify the source code of the fixed version.
- Rebuild with identical options;
php -ishows the original configure line. - Run the tests and install.
- Restart all PHP processes, as described in Restarting PHP-FPM and all workers.
- Check the running version, as explained in Checking the PHP version and patch level properly.
A self-built PHP appears in no package manager. Keep an inventory of which servers run custom builds in which version, otherwise they will be overlooked at the next vulnerability.
How does PHP SOS help?
Through the PHP patch service, we support operators of custom builds:
- Record the inventory: We find self-built PHP versions and read out their build options.
- Rebuild: Fixed version with verified signature, the same options and a complete test run.
- Roll out and restart: Installation, restart of all processes, check of the running version.
- Simplify: Where a maintained package source serves the same purpose, we show how to switch.
Frequently asked questions
When is it worth compiling PHP yourself?
When a required version or option is not available from any trustworthy package source, for development and debugging of PHP itself, or for very lean, special builds. For normal web servers, maintained packages are usually the better choice.
How do I check that the PHP source code is genuine?
php.net offers an SHA-256 checksum and a GPG signature for every source package. Compare the checksum and verify the signature with the release managers' keys published on php.net.
Do I have to recompile after a security release?
Yes. A self-built PHP does not receive updates from the distribution. After PHP2Shell, that meant: build the source of 8.5.12, 8.4.27, 8.3.36 or 8.2.35, install it and restart all PHP processes.
Where do I find all configure options?
With ./configure --help in the source directory. The manual lists the most important core options; options for extensions are on their manual pages.