#1151638 apache2: Backport fix for #1060450 to trixie — PHP package upgrades fail to restart Apache

Package:
apache2
Source:
apache2
Description:
Apache HTTP Server
Submitter:
John Hunt
Date:
2026-10-22 14:37:04 UTC
Severity:
normal
#1151638#5
Date:
2026-10-22 14:14:32 UTC
From:
To:
The fix for Debian bug #1060450 appears to be missing from Debian 13
(Trixie), despite that bug being marked fixed in apache2 2.4.65-3.

We have encountered this issue on multiple production web servers
following PHP package upgrades, affecting both Deb12 and Deb13 with PHP
8.2 and PHP 8.4 upgrades.

Observed behaviour
------------------

On a Debian 13 server:

2026-10-21 15:16:20: PHP 8.4 upgraded from 8.4.26-1~deb13u1 to
8.4.27-1~deb13u1, including libapache2-mod-php8.4 and php8.4-curl.

2026-10-21 15:16:33: dpkg processed the libapache2-mod-php8.4 trigger.

Apache was not restarted following the package upgrade.

2026-10-22 00:46:37: Apache underwent a graceful reload triggered by
logrotate.

PHP subsequently failed with Fatal error: Uncaught Error: Call to
undefined function curl_init().

A full Apache restart immediately resolved the problem.

We have observed a similar issue involving the MySQLi extension on another
Debian 12 server running PHP 8.2.


Cause
-----

The PHP package's post-installation trigger calls apache2_reload restart.

However, the apache2_needs_action() function in
/usr/share/apache2/apache2-maintscript-helper only permits the relevant
postinst action when APACHE2_MAINTSCRIPT_METHOD is configure.

When invoked with triggered, the function returns 1. Consequently,
apache2_reload() returns successfully without actually restarting Apache.

This is precisely the issue described in bug #1060450:
https://bugs.debian.org/1060450

The proposed patch adds handling for APACHE2_MAINTSCRIPT_METHOD=triggered:
https://salsa.debian.org/apache-team/apache2/-/merge_requests/40.diff

However, the Debian 13 source for apache2 2.4.69-1~deb13u1 still lacks
that change:

https://sources.debian.org/src/apache2/2.4.69-1~deb13u1/debian/debhelper/apache2-maintscript-helper/

Expected behaviour
------------------

When PHP packages or extensions are upgraded and the relevant dpkg trigger
executes, Apache should be fully restarted so that the updated PHP module
and extensions are loaded consistently.

This also has security implications. When PHP packages are upgraded to
address security vulnerabilities, Apache may continue running the
previously loaded, potentially vulnerable PHP code until it is manually
restarted, despite the package upgrade having completed successfully.

Request
-------

Could the fix for #1060450 be backported to Debian 13 (Trixie)?

The missing restart is causing production PHP applications to fail
following package upgrades and subsequent Apache graceful reloads.