How to upgrade your PHP version safely
An old PHP version gets no security fixes, and the PHP2Shell attacks of October 2026 showed what that means in practice. Here is how to find your version, upgrade PHP without breaking your site, and when it makes sense to drop PHP altogether.
Why an old PHP version is dangerous
PHP is the language WordPress, WooCommerce, Magento, Joomla and many other systems run on. Each PHP branch gets two years of active support and then security fixes only. After that it reaches end of life, and holes found later are never fixed for it.
PHP2Shell is the live example. In October 2026 two vulnerabilities in PHP itself (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) let attackers run code on the server. The first attacks were seen before the patch came out. PHP fixed them in 8.5.12, 8.4.27, 8.3.36 or 8.2.35; PHP 8.1 and older got no release at all. A security plugin does not help, because the attack happens before WordPress or any plugin runs.
Already patched? On 23 October PHP reported a third issue (CVE-2026-115560) that also affects patched versions in a specific session setup. Until the next PHP release, keep session.upload_progress.enabled = 0 in the server configuration (not in .user.ini). Our full PHP2Shell advisory is in Dutch.
PHP end-of-life dates
Status of each PHP branch, and the first version with the PHP2Shell fix:
| Branch | Support | PHP2Shell fixed in |
|---|---|---|
| PHP 8.5 | Active support | 8.5.12 |
| PHP 8.4 | Active support | 8.4.27 |
| PHP 8.3 | Security fixes only, until 31 Dec 2027 | 8.3.36 |
| PHP 8.2 | Security fixes only, until 31 Dec 2026 | 8.2.35 |
| PHP 8.1 | End of life since 31 Dec 2025 | No release |
| PHP 8.0 | End of life since Nov 2023 | No release |
| PHP 7.4 and older | End of life (7.4 since Nov 2022) | No release |
PHP 8.2 stops getting security fixes on 31 December 2026, so if you upgrade now, aim for PHP 8.3 or newer.
Linux distributions such as Debian and Ubuntu often backport fixes into an older version number. In that case, check the package changelog for the CVE numbers.
How to find your PHP version
- Run our website security check. If your server reveals its PHP version, the report shows it and whether it has the PHP2Shell fix.
- WordPress: go to Tools → Site Health → Info → Server.
- Hosting control panel: look for “PHP version”, “Select PHP Version” or “MultiPHP Manager”.
- On the server:
php -vshows the command-line version, which can differ from the one serving your site. A temporary file with<?php phpinfo();shows the real one; delete it straight after.
How to upgrade PHP safely
- Make a full backup of files and database, stored off the server.
- Create a staging copy. Many hosts offer one-click staging. Never test a PHP upgrade on the live site first.
- Update everything else first: WordPress core, themes and plugins. Old plugins are the usual reason a PHP upgrade fails. Remove the ones you don’t use.
- Scan your code for compatibility. Developers can run PHPCompatibility (a PHP_CodeSniffer standard) or Rector against custom themes and code to find what breaks on the target version.
- Switch PHP on staging and click through every page, form, checkout and admin screen. Turn on error logging and read the log.
- Switch the live site, preferably at a quiet moment, and keep the old version selectable in case you have to roll back.
- Check the logs again over the next days. Deprecation notices are not urgent, but fix them before the next upgrade.
What changes from PHP 7.4 to 8.x
The jump from 7.4 to 8.0 is the big one. After that, each version mostly adds deprecations.
| Upgrade | What to watch for |
|---|---|
| 7.4 → 8.0 | Comparisons between numbers and strings changed (0 == "abc" is now false). Many warnings became errors. each(), create_function() and other old functions were removed. |
| 8.0 → 8.1 | Passing null to built-in functions that expect a string or number is deprecated. Old plugins fill the logs with notices. |
| 8.1 → 8.2 | Dynamic properties (setting an undeclared property on an object) are deprecated. utf8_encode() and utf8_decode() are deprecated. |
| 8.3 → 8.4 | Implicitly nullable parameter types (string $x = null) are deprecated. Mostly notices, rarely breakage. |
A plugin that has not been updated in years and fails on PHP 8 is a warning in itself. Replacing it is usually safer than patching it.
The alternative: drop PHP
Upgrading PHP is a recurring job. PHP 8.2 reaches end of life at the end of 2026 and 8.3 a year later, and each upgrade means another round of testing. For a site with a handful of fixed pages, that is a lot of upkeep for very little.
The sites we build are static: plain HTML files, with no PHP, no database and no plugins on the server. PHP2Shell did not affect any of them, because there is no PHP to attack. We migrate WordPress sites with your copy, images and Google rankings intact, and maintain them for €39 a month (excl. VAT), including an hour of changes. You see a free preview first.
Questions
Is PHP 7.4 still safe to use?
No. PHP 7.4 reached end of life in November 2022 and gets no security fixes, so it is exposed to PHP2Shell and every other hole found since. Expect the move to 8.x to need the most testing; see the table of changes above.
When is PHP 8.1 end of life?
On 31 December 2025, which is why PHP released no PHP2Shell fix for it. Some Linux distributions with long-term support still backport security fixes to their own 8.1 packages, so check your distribution’s changelog if that is your setup.
Will upgrading PHP break my WordPress site?
It can, usually because of an old plugin or theme rather than WordPress itself. If it does, most hosting panels let you switch back to the previous PHP version in one click.
Who is responsible for upgrading PHP, me or my host?
On shared hosting, your host installs the PHP versions and often lets you choose one per site in the control panel. Choosing a newer version, and making sure your site works on it, is usually up to you or your developer.
Can I avoid PHP altogether?
For most brochure-style business sites, yes. A static site serves plain HTML files, with no PHP on the server, so there is no PHP version to keep up with.
Keeping WordPress? Read what WordPress maintenance involves, PHP upgrades included.
Stuck on an old PHP version?
Send us your domain. We will tell you what an upgrade involves, or show you a preview of the same site without PHP.