PHP 8.1 end of life and PHP2Shell: how to upgrade PHP safely

The PHP2Shell fixes of October 21, 2026 shipped for four branches only: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to the php.net security advisory. If your website still runs PHP 8.1, 8.0, 7.4 or older, there is no official update for it. This note explains what that means and how to move to a supported version without breaking your site.

New to PHP2Shell? Start with PHP2Shell: what small businesses should do this week. Not sure which version you run? See how to check your PHP version in WordPress or cPanel.

PHP 8.1 end of life: the dates

The php.net list of unsupported branches gives these end of life dates:

• PHP 8.1: December 31, 2025 (last release 8.1.34)
• PHP 8.0: November 26, 2023 (last release 8.0.30)
• PHP 7.4: November 28, 2022 (last release 7.4.33)

End of life means the branch is no longer supported. The php.net supported versions page warns that users of an end of life release should upgrade as soon as possible, as they may be exposed to unpatched security vulnerabilities. PHP2Shell is a clear example.

Is PHP 7.4 affected by PHP2Shell?

The official advisories list affected versions as everything below the four fixed releases, and only the supported branches received new versions. Other sources describe the older range directly. Google Cloud lists the vulnerable versions as all PHP from 5.4 through 8.5.11, and Cloudflare says the vulnerabilities affect all web servers running PHP 5.4 or later. The UK NCSC encourages organisations on older PHP to update to a fully supported version.

There is one nuance. Given the severity, php.net says the PHP security team provided minimal source backports for PHP 7.4, 8.0 and 8.1, for people who build PHP from source or have no LTS vendor. Some Linux distributions and LTS vendors also provide backported fixes. So a host running PHP 7.4 may have patched it. Only the host can confirm, in writing.

Which PHP versions are supported?

The php.net supported versions page gives these security support end dates:

• PHP 8.2: December 31, 2026
• PHP 8.3: December 31, 2027
• PHP 8.4: December 31, 2028
• PHP 8.5: December 31, 2029

PHP 8.2 is fixed for PHP2Shell in 8.2.35, but php.net’s release note says it reaches end of life on December 31, 2026 and asks users to plan an upgrade. For a WordPress site, WordPress recommends that your host supports PHP 8.3 or greater. A fixed release of PHP 8.3 or later covers both PHP2Shell and that recommendation.

How to upgrade PHP safely

An upgrade from PHP 7.4 or 8.1 is a bigger step than a security update, because code written for an old branch may not behave the same on a new one. The WordPress guide to updating PHP sets out the careful order:

• Make a backup of the website first, so you can go back if something breaks. WordPress notes that to revert, your host also needs to move your PHP version back.
• Update WordPress, themes and plugins before changing PHP. WordPress says popular or reputable ones almost certainly will work on newer PHP, but they should be tested to make sure.
• Check compatibility. WordPress suggests a PHP compatibility checker plugin, and notes it is not perfect and can miss issues or flag false positives.
• If your host offers a staging copy, test the new PHP version there first.
• Ask your host to switch PHP, or use the PHP version tool in your hosting panel, then check the main pages and forms of your site.
• If something breaks, revert, note the error, and ask your developer to fix the plugin or code before trying again.

For developers, php.net publishes migration guides between branches, such as migrating from PHP 8.1 to 8.2.

What to ask your host this week

• Which exact PHP version runs our site today?
• If it is 8.1 or older: is there a vendor backport of the PHP2Shell fix, and on what date was it applied?
• Which supported, fixed version can we move to, and can we test it on a staging copy first?
• Are any other copies of the site, such as staging or an old subdomain, still on old PHP?

Our PHP2Shell exposure check page has the full host checklist and the fixed versions table. You can also request a free PHP2Shell exposure check: we note what your site publicly reports within 24 hours, with no login, no scanning for weaknesses and no exploit testing. We do not change servers or quote prices.

Sources

• php.net security advisory, October 21, 2026
• php.net: unsupported branches and supported versions
• PHP manual: migrating from PHP 8.1 to 8.2
• WordPress: Update PHP and WordPress requirements
• UK NCSC: Critical security issue affecting PHP
• Google Cloud: responding to CVE-2026-109618 and CVE-2026-109619 and Cloudflare: protections against php2shell