# Debian 13 and Ubuntu 26.04 for web hosting: what changed

> Debian 13 web server guide: PHP, nginx, Apache, MariaDB, PostgreSQL, Dovecot and kernel versions in Debian 12/13 and Ubuntu 24.04/26.04, plus support dates.

Source: https://zopanel.net/blog/debian-13-ubuntu-26-04-web-hosting  
Updated: 2026-10-21

## Key takeaways

- Debian 13 ships PHP 8.4, nginx 1.26, MariaDB 11.8, PostgreSQL 17 and kernel 6.12; Ubuntu 26.04 ships PHP 8.5, nginx 1.28, MariaDB 11.8, MySQL 8.4, PostgreSQL 18 and kernel 7.0.
- Both move to Dovecot 2.4, whose configuration format is incompatible with 2.3, so a mail server needs its config rewritten before or during the upgrade.
- Debian 12 left regular security support on 12 July 2026 and is now on LTS until 30 June 2028.
- packages.sury.org builds PHP 5.6 to 8.5 for both trixie and resolute, while the ondrej/php PPA covers only Ubuntu 22.04 and 24.04.

For a new Debian 13 web server, you get PHP 8.4, nginx 1.26, Apache 2.4, MariaDB 11.8, PostgreSQL 17, Postfix 3.10, Dovecot 2.4, OpenSSL 3.5 and Linux 6.12 straight from the Debian archive. Ubuntu 26.04 LTS goes one step further with PHP 8.5, nginx 1.28, MySQL 8.4, PostgreSQL 18 and Linux 7.0. Both are good choices for hosting in late 2026, but the jump from Debian 12 or Ubuntu 24.04 changes the mail server configuration (Dovecot 2.4), the PHP repository you use for older PHP versions and several system defaults.

Every version below was checked in October 2026 against the Debian and Ubuntu archives.

## Release and support dates

| Release | Codename | Released | Regular / standard support ends | Extended support |
| --- | --- | --- | --- | --- |
| Debian 12 | bookworm | 10 June 2023 | Ended 12 July 2026 | Debian LTS until 30 June 2028 |
| Debian 13 | trixie | 9 August 2025 | About 3 years after release (August 2028) | Debian LTS until 30 June 2030 |
| Ubuntu 24.04 LTS | noble | April 2024 | May 2029 | Ubuntu Pro (ESM) until May 2034 |
| Ubuntu 26.04 LTS | resolute | 23 April 2026 | May 2031 | Ubuntu Pro (ESM) until May 2036 |

Sources: [Debian LTS wiki](https://wiki.debian.org/LTS), [Debian announcement of the bookworm handover to LTS](https://www.debian.org/News/2026/20260712.en.html), [Ubuntu release cycle](https://ubuntu.com/about/release-cycle) and the [Ubuntu 26.04 release notes](https://documentation.ubuntu.com/release-notes/26.04/).

The practical point: **Debian 12 is now on LTS.** Security fixes still arrive, but from the volunteer LTS team, on fewer architectures (amd64, i386, arm64, armhf and ppc64el), and Debian itself encourages users to move to Debian 13 where possible. A server you set up today should be on Debian 13 or Ubuntu 26.04 unless you have a reason to wait.

## Package versions: Debian 12, Debian 13, Ubuntu 24.04, Ubuntu 26.04

| Software | Debian 12 | Debian 13 | Ubuntu 24.04 | Ubuntu 26.04 |
| --- | --- | --- | --- | --- |
| PHP | 8.2 | 8.4 | 8.3 | 8.5 |
| nginx | 1.22.1 | 1.26.3 | 1.24.0 | 1.28.3 |
| Apache | 2.4.68 | 2.4.68 / 2.4.69 (security) | 2.4.58 | 2.4.66 |
| MariaDB | 10.11 | 11.8 | 10.11 | 11.8 |
| MySQL | not in archive (MariaDB is the default) | not in archive (MariaDB is the default) | 8.0 | 8.4 LTS |
| PostgreSQL | 15 | 17 | 16 | 18 |
| Postfix | 3.7 | 3.10 | 3.8 | 3.10 |
| Dovecot | 2.3.19 | 2.4.1 | 2.3.21 | 2.4.2 |
| Linux kernel | 6.1 | 6.12 | 6.8 | 7.0 |
| OpenSSL | 3.0 | 3.5 | 3.0 | 3.5 |

How we checked: Debian versions come from the [Debian archive (madison)](https://qa.debian.org/madison.php?package=nginx&s=bookworm,trixie) and the [trixie release notes](https://www.debian.org/releases/trixie/release-notes/whats-new.en.html); Ubuntu versions come from the published sources on Launchpad, for example [nginx](https://launchpad.net/ubuntu/+source/nginx), [php8.5](https://launchpad.net/ubuntu/+source/php8.5), [mysql-8.4](https://launchpad.net/ubuntu/+source/mysql-8.4) and [dovecot](https://launchpad.net/ubuntu/+source/dovecot), and from the [Ubuntu 26.04 summary for LTS users](https://documentation.ubuntu.com/release-notes/26.04/summary-for-lts-users/). Point versions change with security updates. Debian ships new upstream Apache 2.4.x releases as stable updates, which is why Debian 12 now has a newer Apache than Ubuntu 24.04.

On Debian, `default-mysql-server` [depends on MariaDB](https://packages.debian.org/trixie/default-mysql-server); if you need MySQL itself on Debian, you have to add an outside repository.

## What changed for web hosting

### PHP 8.4 and 8.5 by default

Debian 13 moves from PHP 8.2 to 8.4, and Ubuntu 26.04 from 8.3 to 8.5. Test older plugins, themes and custom code before you move a site, because each PHP release removes deprecated features. Distributions ship **one** PHP version, so any site that needs another needs a third-party repository (see below). Our guide to [running multiple PHP versions on one server](/blog/multiple-php-versions) covers the setup in detail.

### nginx 1.26 and 1.28, Apache 2.4

nginx moves from 1.22 to 1.26 on Debian and from 1.24 to 1.28 on Ubuntu; Apache stays on 2.4 everywhere, so `.htaccess` behaviour does not change. If you build a stack by hand, our [LEMP stack on Ubuntu](/blog/lemp-stack-ubuntu) guide applies to both new releases.

### Databases: MariaDB 11.8, MySQL 8.4, PostgreSQL 17 and 18

MariaDB goes from 10.11 to 11.8 on both Debian 13 and Ubuntu 26.04, a major version jump. The Debian release notes warn that [MariaDB does not support error recovery across major versions](https://www.debian.org/releases/trixie/release-notes/issues.en.html#mariadb-major-version-upgrades-only-work-reliably-after-a-clean-shutdown): stop the service and check the log says `Shutdown complete` before you upgrade, and take a dump first.

Ubuntu 26.04 replaces MySQL 8.0 with 8.4 LTS. According to the [Ubuntu release notes](https://documentation.ubuntu.com/release-notes/26.04/summary-for-lts-users/), accounts that still use the `mysql_native_password` plugin are locked out by default. You either move those users to `caching_sha2_password` (which resets their passwords) or set `mysql_native_password=ON` under `[mysqld]`, an option Ubuntu says will not work in future releases with MySQL 9.7 or newer. This affects Ubuntu's MySQL package, not MariaDB.

PostgreSQL moves to 17 on Debian 13 and 18 on Ubuntu 26.04; a major version change needs a planned data migration.

## What changed for email: Dovecot 2.4

This is the change most likely to break a working server. Both Debian 13 (2.4.1) and Ubuntu 26.04 (2.4.2) move to Dovecot 2.4, and the Debian release notes say the new configuration format is ["incompatible with previous versions"](https://www.debian.org/releases/trixie/release-notes/issues.en.html#dovecot-configuration-changes). Ubuntu's notes say the same and point to Dovecot's [2.3 to 2.4 upgrade guide](https://doc.dovecot.org/main/installation/upgrade/2.3-to-2.4.html).

| Dovecot 2.3 | Dovecot 2.4 |
| --- | --- |
| No version line needed | `dovecot_config_version` must be the first setting; `dovecot_storage_version` is required |
| `mail_location = maildir:~/Maildir` | `mail_driver = maildir` and `mail_path = ~/Maildir` |
| `ssl_cert`, `ssl_key` | `ssl_server_cert_file`, `ssl_server_key_file` |
| `disable_plaintext_auth` | `auth_allow_cleartext` |
| `%u`, `%d` | `%{user}`, `%{user \| domain}` |
| `plugin { }` section | Plugin settings are global |
| Unnamed `passdb { }` | Each `passdb` and `userdb` needs a name |
| `replicator`, `director` | Removed |

Other removals listed in the upstream guide include the `checkpassword` and `shadow` auth drivers, `fts-lucene` and `fts-squat`, and the `zlib` plugin. Global Sieve scripts must be recompiled with `sievec`. If you depend on the replicator for two-server mail, Debian advises not to upgrade until you have an alternative.

Postfix moves to 3.10 on both. On Ubuntu 26.04, Postfix is [no longer installed in a chroot by default](https://documentation.ubuntu.com/release-notes/26.04/summary-for-lts-users/), with only limited chroot support. For a full mail setup, see [running an email server on a VPS](/blog/email-server-on-vps).

## System changes that affect servers

| Change | Debian 13 | Ubuntu 26.04 |
| --- | --- | --- |
| `/tmp` | Now a tmpfs in RAM, capped at 50% of memory by default | Not listed in the LTS summary |
| OpenSSH | 10.0p1, DSA keys no longer supported | 10.2p1, DSA removed, post-quantum key exchange by default |
| `/etc/sysctl.conf` | No longer read; use `/etc/sysctl.d/*.conf` | Not listed |
| `sudo` | Not listed | `sudo-rs` is the default provider |
| Core utilities | Not listed | `rust-coreutils` (GNU `cp`, `mv`, `rm` kept) |
| cgroup v1 | Not listed | Removed (systemd 259) |
| `last`, `lastb`, `lastlog` | Replaced by wtmpdb and lastlog2 | Not listed |
| Time sync | Not listed | chrony replaces systemd-timesyncd on new installs |

Sources: [Debian 13 issues to be aware of](https://www.debian.org/releases/trixie/release-notes/issues.en.html) and the [Ubuntu 26.04 summary for LTS users](https://documentation.ubuntu.com/release-notes/26.04/summary-for-lts-users/). On a small VPS, the tmpfs `/tmp` on Debian 13 means large files written there use RAM; resize it with `systemctl edit tmp.mount`. Kernel settings in `/etc/sysctl.conf` must move to `/etc/sysctl.d/`. Our [Ubuntu VPS security guide](/blog/secure-ubuntu-vps) covers the rest of the baseline.

Neither release supports skipping a version: Debian 11 must go through 12, and Ubuntu 22.04 must go through 24.04 (or 25.10) before 26.04.

## The PHP repository for older versions

The usual source for several PHP versions side by side is Ondřej Surý's packages. The situation changed with Ubuntu 26.04, and we checked it directly on 21 October 2026:

| Repository | Debian 13 trixie | Ubuntu 26.04 resolute |
| --- | --- | --- |
| [packages.sury.org/php](https://packages.sury.org/php/dists/) | Yes: PHP 5.6 to 8.5, plus 8.6 release candidates, amd64 and arm64 | Yes: same versions, amd64 and arm64 |
| [ppa:ondrej/php](https://launchpad.net/~ondrej/+archive/ubuntu/php) | Not applicable (Ubuntu only) | No: the PPA publishes only Jammy (22.04) and Noble (24.04) |

The PPA description says the repository is being merged into packages.sury.org/php, that packages.sury.org/php is "the canonical way of getting PHP packages" for Ubuntu Resolute, and that Jammy and Noble can still use the PPA. So on Ubuntu 26.04, `add-apt-repository ppa:ondrej/php` is the wrong instruction; add packages.sury.org the same way you would on Debian. As with any third-party repository, you are trusting its maintainer with root on your server.

## Which one should you pick?

- **Debian 13**: a conservative base, PHP 8.4, LTS until 2030.
- **Ubuntu 26.04**: the newest stack (PHP 8.5, PostgreSQL 18, kernel 7.0), MySQL 8.4, standard support to 2031.
- **Ubuntu 24.04**: stay for now if a key application is not tested on PHP 8.5 or MySQL 8.4 (support to May 2029).
- **Debian 12**: plan to leave before LTS ends on 30 June 2028.

## How ZoPanel handles Debian 13 and Ubuntu 26.04

ZoPanel supports Ubuntu 22.04, 24.04 and 26.04 and Debian 12 and 13, on x86-64 and ARM64 ([system requirements](/docs/requirements)). On Debian 13 the kernel is already 6.8 or newer, so features such as compressing idle memory in RAM work without a kernel change. ZoPanel detects the installed Dovecot version and writes the 2.4 configuration format on Debian 13 and Ubuntu 26.04, so you do not translate mail settings by hand.

There is one limit to be upfront about. On Ubuntu 26.04, ZoPanel currently offers **only PHP 8.5** from Ubuntu's archive, and it does not yet use packages.sury.org there, so applications that need an older PHP (PrestaShop, for example) cannot be installed on that release. On Debian 13 and Ubuntu 24.04, PHP 7.4 to 8.4 are available side by side. If you need several PHP versions today, choose Debian 13 or Ubuntu 24.04. Installing takes one command on a fresh server: `curl -fsSL https://get.zopanel.net | sudo bash` (see [Install ZoPanel](/docs/install)). For the hosting features themselves, see [hosting features](/features/hosting).

## Conclusion

Debian 13 and Ubuntu 26.04 are both solid hosting platforms with newer PHP, nginx, MariaDB and OpenSSL than their predecessors. The upgrade itself is where the work is: rewrite Dovecot for 2.4, shut MariaDB down cleanly before the major version jump, check MySQL 8.4 accounts on Ubuntu, and switch from the ondrej PPA to packages.sury.org on Ubuntu 26.04.

If you would rather not manage these differences per release yourself, ZoPanel's Free plan covers 3 hosting accounts, 10 websites and 10 databases with no time limit. See [pricing](/pricing).

## Frequently asked questions

### Is Debian 13 good for a web server?

Yes. Debian 13 ships PHP 8.4, nginx 1.26, Apache 2.4, MariaDB 11.8 and PostgreSQL 17, with regular security support for about three years and Debian LTS until 30 June 2030. It is a conservative, low-maintenance base for nginx or Apache hosting.

### What PHP version does Debian 13 have?

PHP 8.4. Debian 12 had 8.2. For other versions, add packages.sury.org, which publishes PHP 5.6 to 8.5 for trixie on amd64 and arm64.

### Does ppa:ondrej/php support Ubuntu 26.04?

No. In October 2026 the PPA publishes packages only for Ubuntu 22.04 and 24.04, and its description says packages.sury.org/php is the canonical source for Ubuntu Resolute (26.04). packages.sury.org carries PHP 5.6 to 8.5 for resolute.

### Can I upgrade Debian 12 to Debian 13 with a mail server on it?

Yes, but port your Dovecot configuration to the 2.4 format first, ideally on a test server, because the old format does not load. If you use Dovecot's replicator, Debian advises not to upgrade until you have an alternative, since 2.4 removed it.

### Is Debian 12 still supported?

Yes, through Debian LTS until 30 June 2028. Regular security support ended on 12 July 2026, and LTS covers fewer architectures and packages, so plan the move to Debian 13 within that window.