How To Install PHP 7.4 on Kali Linux

PHP 7.4 still installs on Kali Linux rolling, but the old way of doing it no longer works. Pointing apt at the Sury repository’s bullseye suite now stops on libffi7 and then libssl1.1, and the trixie suite stops on libsodium23 and libxml2, because Kali has already moved those libraries to newer sonames. What works today is the Sury trixie suite plus a low-priority Debian trixie source that supplies only those two libraries.

Original content from computingforgeeks.com - post 47770

PHP 7.4 is long past its upstream end of life, so php.net ships no more releases for it. The builds that still get security fixes are Ondřej Surý’s backports, and they already carry the October 2026 PHP2Shell fix, which is the main reason to install from Sury rather than an old tarball or container image. The install, the Nginx and PHP-FPM setup and the PHP2Shell check below were run on a fresh Kali Linux rolling 2026.3 system in October 2026 with PHP 7.4.33 from Sury.

How To Install PHP 7.4 on Kali Linux

Follow the steps below to install PHP 7.4 on Kali Linux. Kali’s own archive only carries the current PHP branch, so PHP 7.4 comes from the SURY PHP repository, and two old libraries come from Debian 13. We’ll add both sources first, then install PHP 7.4 and wire it to Nginx.

Step 1: Update system

Bring the system fully up to date before you add any outside repository, because apt resolves PHP’s dependencies against whatever library versions are installed right now:

sudo apt update
sudo apt full-upgrade -y

If the upgrade pulled in a new kernel, reboot before you continue, so you’re not debugging an install on a half-upgraded box. Compare the running kernel from uname -r with the newest file in ls /boot/vmlinuz-*; if they differ, reboot. Once the system is current, add the SURY PHP repository.

Step 2: Add SURY PHP repository

Sury now ships its signing key as a small package, debsuryorg-archive-keyring, and the repository line points at that keyring with signed-by. That replaces the old apt.gpg download into /etc/apt/trusted.gpg.d/, which made apt trust Sury’s key for every repository on the box. Install curl and the keyring:

sudo apt install -y curl ca-certificates
curl -sSLo /tmp/debsuryorg-archive-keyring.deb https://packages.sury.org/debsuryorg-archive-keyring.deb
sudo dpkg -i /tmp/debsuryorg-archive-keyring.deb

Then add the repository. Use the trixie suite: Sury has no suite for Kali or Debian testing, and trixie is the newest one it builds, so it’s the closest match to Kali rolling’s libraries.

echo "deb [signed-by=/usr/share/keyrings/debsuryorg-archive-keyring.gpg] https://packages.sury.org/php/ trixie main" | sudo tee /etc/apt/sources.list.d/php.list

If you followed an older version of this guide, delete the old key with sudo rm -f /etc/apt/trusted.gpg.d/php.gpg; the tee above already replaced the bullseye line. If the old install never got past the libffi7 error, remove the hand-installed package now with sudo dpkg -r libffi7. If an old bullseye PHP 7.4 is actually installed and running, leave libffi7 alone until Steps 3 and 4 have upgraded PHP to the trixie builds, then run sudo apt purge libffi7 once nothing depends on it.

Step 3: Add Debian trixie for two libraries

Sury’s trixie builds of PHP 7.4 link against libsodium23 and libxml2, and Kali rolling no longer has either: it ships libsodium26 and libxml2-16 instead. Without them the install fails; a dry run of apt install -s php7.4-cli names the culprit as Depends: libsodium23 (>= 1.0.14) but it is not installable.

Be clear about what this step does: Kali does not support it. The Kali apt sources documentation says adding another operating system’s repositories will break your installation and calls it the single most common reason Kali systems break. If you need PHP 7.4 for more than a lab, run it on Debian 13 instead, where Sury’s packages install without any borrowed libraries. On Kali, keep the exposure small: Debian 13 main plus its security pocket, so the two borrowed libraries still receive Debian’s security updates.

echo "deb [signed-by=/usr/share/keyrings/debian-archive-keyring.gpg] http://deb.debian.org/debian trixie main" | sudo tee /etc/apt/sources.list.d/debian-trixie.list
echo "deb [signed-by=/usr/share/keyrings/debian-archive-keyring.gpg] http://security.debian.org/debian-security trixie-security main" | sudo tee -a /etc/apt/sources.list.d/debian-trixie.list

Now pin everything from Debian to priority 100, so apt only takes a package from Debian when Kali does not have it at all. The pin matches the origin o=Debian, not the codename. We tried n=trixie first and it also matched Sury’s repository, which calls itself trixie too, so Kali’s php-common won and apt refused to install PHP 7.4 because that package breaks php7.4-common.

printf "Package: *\nPin: release o=Debian\nPin-Priority: 100\n" | sudo tee /etc/apt/preferences.d/debian-trixie.pref

With this pin in place, a later apt full-upgrade takes nothing from Debian except those two libraries; on our box a dry run after PHP was in had nothing to install, upgrade or remove. Sury is different, because its packages sit at the same priority as Kali’s: if Kali’s php8.4 packages are already installed, the next full-upgrade replaces them and php-common with Sury’s builds, which we saw happen on a box that had Kali’s PHP first. To back the change out later, delete both files and refresh the index with sudo rm /etc/apt/sources.list.d/debian-trixie.list /etc/apt/preferences.d/debian-trixie.pref && sudo apt update. PHP keeps working after that, but the two libraries stop getting updates.

Step 4: Install PHP 7.4 on Kali Linux

Refresh the package index so apt sees the new sources:

sudo apt update

Then install PHP 7.4. The php7.4 metapackage pulls in Apache with libapache2-mod-php7.4, and the only packages that come from Debian are libsodium23 and libxml2.

sudo apt install php7.4

If you only plan to serve PHP through Nginx, skip the metapackage and run sudo apt install php7.4-fpm php7.4-cli instead. We tested that on a fresh box and Apache never got installed. If the install stops on a libffi7 dependency error, the fix is at the end of this step. Confirm the PHP version installed:

php7.4 -v

The build date tells you this is Sury’s October 2026 rebuild and not an old package:

PHP 7.4.33 (cli) (built: Oct 21 2026 08:20:05) ( NTS )
Copyright (c) The PHP Group
Zend Engine v3.4.0, Copyright (c) Zend Technologies
    with Zend OPcache v7.4.33, Copyright (c), by Zend Technologies

Extensions are separate packages named after the branch, so you install them with the php7.4- prefix and the extension name. Pick only what your application needs, since every extension you load is more code exposed to requests:

sudo apt install php7.4-xxx

A typical set for a CMS or a Laravel app looks like this, and all ten of these installed cleanly from Sury on our Kali box:

sudo apt-get install php7.4-{cli,json,imap,bcmath,bz2,intl,gd,mbstring,mysql,zip}

The php.ini that Apache’s mod_php reads lives in /etc/php/7.4/apache2/php.ini, while the CLI and PHP-FPM each have their own copy under /etc/php/7.4/cli/ and /etc/php/7.4/fpm/. Edit the one for the SAPI you actually serve pages with, or you’ll change a setting and see no difference in the browser.

Fixing error ‘Depends: libffi7 (>= 3.3~20180313)’

This error means apt is still reading the Sury bullseye suite. On current Kali rolling it looks like this:

Error: Unable to satisfy dependencies. Reached two conflicting assignments:
   1. php7.4-common:amd64 is selected for install because:
      1. php7.4:amd64=1:7.4.33-31+0~20261021.121+debian11~1.gbpe9c428 is selected for install
      2. php7.4:amd64 Depends php7.4-common
   2. php7.4-common:amd64 Depends libffi7 (>= 3.3~20180313)
      but none of the choices are installable:
      [no choices]

Installing a downloaded libffi7 package by hand, which older versions of this guide suggested, no longer gets you through. We tried it and the very next run failed on Depends: libssl1.1 (>= 1.1.0), which Kali dropped long ago. Switch the repository line to trixie as shown in Step 2, add the Debian source from Step 3, and run the install again.

Step 5: Using PHP with Nginx

The php7.4 metapackage installs Apache with mod_php. Kali leaves Apache disabled and stopped after the install, but disable it explicitly anyway if you want Nginx, so a later systemctl enable or reboot cannot bring it back onto port 80. Skip this line if you took the Nginx-only route in Step 4, because Apache isn’t installed and systemctl answers with Unit apache2.service does not exist:

sudo systemctl disable --now apache2

Install Nginx and PHP-FPM 7.4. FPM runs PHP as its own service with a pool of workers, and Nginx passes PHP requests to it over a socket, so you need both packages:

sudo apt install nginx php7.4-fpm

Kali does not start or enable network services when you install them, so start both and enable them at boot:

sudo systemctl enable --now php7.4-fpm nginx

PHP FPM configuration files are located in the directory: /etc/php/7.4/fpm/. The default www pool lives in /etc/php/7.4/fpm/pool.d/www.conf, and you can read its active settings without the comments:

grep -Ev '^(;|$)' /etc/php/7.4/fpm/pool.d/www.conf

The pool listens on a Unix socket, and that socket path is what Nginx needs:

[www]
user = www-data
group = www-data
listen = /run/php/php7.4-fpm.sock
listen.owner = www-data
listen.group = www-data
pm = dynamic
pm.max_children = 5
pm.start_servers = 2
pm.min_spare_servers = 1
pm.max_spare_servers = 3

Nginx does not hand .php files to PHP-FPM until a server block tells it to, and Kali’s default site leaves the PHP location commented out. Open the default site:

sudo vim /etc/nginx/sites-available/default

Replace its contents with this server block, which passes PHP requests to the 7.4 socket:

server {
    listen 80 default_server;
    listen [::]:80 default_server;

    root /var/www/html;
    index index.php index.html index.htm;
    server_name _;

    location / {
        try_files $uri $uri/ =404;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php7.4-fpm.sock;
    }
}

Test the configuration and reload Nginx:

sudo nginx -t
sudo systemctl reload nginx

Check that both services are up:

systemctl is-active php7.4-fpm nginx

Each unit should print active on its own line. If php7.4-fpm prints failed instead, systemctl status php7.4-fpm and its journal usually name the pool file and line it could not parse:

active
active

A running service does not prove Nginx reaches PHP, so request a page through it. Create a small test file:

echo '<?php echo PHP_VERSION, " ", PHP_SAPI, "\n";' | sudo tee /var/www/html/info.php > /dev/null
curl -s http://localhost/info.php

The curl output should show the PHP version and fpm-fcgi, which confirms Nginx handed the request to PHP-FPM 7.4. A 502 means the socket path in the server block does not match the pool, and raw PHP source in the reply means the location ~ \.php$ block is not active:

7.4.33 fpm-fcgi

Delete the test file with sudo rm /var/www/html/info.php once you’ve seen it work, since it tells anyone who asks which PHP build the server runs.

Check the PHP2Shell fix (CVE-2026-109618, CVE-2026-109619)

PHP2Shell is a pair of critical remote code execution bugs in PHP itself, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. PHP fixed them on 21 October 2026 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (PHP’s advisory), and PHP 7.4 got no upstream release. Sury’s PHP 7.4 package 1:7.4.33-31 carries the backported fix, so a fresh install from Step 4 is already patched. Because the backport keeps the version at 7.4.33, php -v cannot tell you that. The package changelog can:

zgrep -E 'CVE-2026-10961[89]' /usr/share/doc/php7.4-common/changelog.Debian.gz

A patched build prints the backport entry from the 1:7.4.33-31 changelog stanza. If the command prints nothing, your php7.4-common predates the fix:

   + [CVE-2026-109618, CVE-2026-109619]: Avoid state corruption via

Kali’s own PHP is a different story. On 22 October the kali-rolling archive still had php8.4 8.4.24-1, which has no fix; Debian sid already had 8.4.27-1, and Kali picks it up only after it moves through Debian testing. To see where your php8.4 packages would come from, check the policy:

apt-cache policy php8.4-common

The http.kali.org line is Kali’s build, and anything below 8.4.27 there is unpatched. With the sources from Steps 2 and 3 added, Sury’s fixed 8.4.27 is the candidate, and Debian’s fixed security build sits at priority 100 behind it:

php8.4-common:
  Installed: (none)
  Candidate: 8.4.27-1+0~20261021.57+debian13~1.gbp7636b9
  Version table:
     8.4.27-1+0~20261021.57+debian13~1.gbp7636b9 500
        500 https://packages.sury.org/php trixie/main amd64 Packages
     8.4.27-1~deb13u1 100
        100 http://security.debian.org/debian-security trixie-security/main amd64 Packages
     8.4.24-1 500
        500 http://http.kali.org/kali kali-rolling/main amd64 Packages
     8.4.24-1~deb13u1 100
        100 http://deb.debian.org/debian trixie/main amd64 Packages

If PHP 7.4 was installed from Sury before 21 October, upgrade it in place. The glob only matches packages whose names start with php7.4, so name the Apache module explicitly if you use mod_php:

sudo apt update
sudo apt install --only-upgrade 'php7.4*' libapache2-mod-php7.4

Old PHP code stays in memory until the processes that loaded it restart, so restart PHP-FPM yourself. On a mod_php setup restart Apache instead with sudo systemctl restart apache2, but not on the Nginx box from Step 5, where that would start Apache and fight Nginx for port 80:

sudo systemctl restart php7.4-fpm

Since the version string stays at 7.4.33, the test page cannot show the difference. Check when the unit last started instead:

systemctl show -p ActiveEnterTimestamp php7.4-fpm

The timestamp must be later than your upgrade. Ours, taken right after the restart, read:

ActiveEnterTimestamp=Thu 2026-10-22 15:22:54 UTC

For mod_php, run the same check against apache2. Then run the zgrep check again, and only call the box patched once it prints the CVE line.

That gives you a working PHP 7.4 stack on Kali Linux with the PHP2Shell backport in place. Keep the Sury and Debian trixie sources, because any further PHP 7.4 rebuilds from Sury and fixes for the two Debian libraries arrive through the same apt upgrade you already run. If you are setting PHP up on another distribution, these guides cover it:

• Install PHP on Debian 13 and 12
• Install PHP 8.5 on Debian 13 with Nginx and PHP-FPM
• Install PHP on Ubuntu
• Install PHP on Fedora
• Install PHP on RHEL, Rocky Linux and AlmaLinux

PHP Web Programming Video Courses:

• The Complete Web Developer Course
• PHP for Beginners – Become a PHP Master – CMS Project
• The Complete PHP Full Stack Web Developer Bootcamp
• PHP with Laravel for beginners – Become a Master in Laravel
• PHP OOP: Object Oriented Programming for beginners + Project

Whichever distribution guide you follow, run that distribution’s own PHP2Shell check after the install, because the version string alone does not show whether a backport landed.