Home / server / Questions / 265090
In Process
Josh Brower
Asked: 2011-05-01 12:44:29 +0800 CST

How often to upgrade PHP & MySQL

  • 772

I run a couple of IIS + PHP + MySQL Web servers, that run a variety of web apps (Wordpress, Expression Engine, etc.)

I know that I should always keep my web apps updated, but I wonder how often I should be updating PHP & Mysql? It seems that the majority of the updates are bug fixes, stability enhancements, new features, and sometimes, security patches.

It can be quite intensive to test and roll out a PHP/MySQL update, so I would rather keep them to a minimum, if at all possible.

Should I just plan to update to the most recent PHP & MySQL every 4/6/? weeks, or earlier, if there is a needed security patch?

Any thoughts?

mysql php update best-practices

2 Answers

  1. I'd agree with the 4/6 week update pattern, as you are hosting an important service, the chance of somebody abusing a bug in either PHP or MySQL is larger than someone hosting a smaller service.

    • 1

  2. As a rule, for MySQL, unless you're looking for particular functionality implemented in a new version, there's no real need to upgrade between minor versions unless a security vulnerability is fixed. Even then, if your server is correctly configured, MySQL should not be listening on a public interface anyway, and additionally should be firewalled off from outside access, so any security vulnerability should effectively have zero effect on you.

    Similar scenario for PHP. You only really need to install new modules as required, or perform a complete update in the event that a security vulnerability is fixed. In any case, you're far more likely to be hacked through an incorrectly configured php.ini file (and subsequently a hole in a piece of sloppy code which makes use of this misconfiguration, for example, opening a URL as a file) than you would through a vulnerability in PHP itself, since these are fairly uncommon.

    I think a 4-6 week update cycle is a bit too often to be worth it. Rather look at upgrading PHP / MySQL every 4-6 months, and rather focus on upgrading the individual web applications, as these will have fixes pertaining to security issues far more regularly. I suggest subscribing to some security bulletins, and upgrading your web applications as soon as there are fixes available, never waiting more than a few days after a security issue has been identified and fixed.

    Most importantly, you should look at incorporating this update cycle into your company's policy and procedure documents. It's always so easy to let updates slide when there are seemingly more important things on the go.

    • 0