Is PHP safe? The language versus the version you run

WindowsMacUpdated

The PHP project gives each version of PHP four years of support, and after that it stops fixing security problems in it. So whether PHP is safe for your website depends less on the language than on which version your site runs, and whether that version is patched. This guide is accurate as of 23 October 2026.

Quick answer

PHP is safe to use when your site runs a version the PHP project still supports, updated to its latest release. As of 23 October 2026 that means PHP 8.2, 8.3, 8.4 or 8.5, at or above 8.2.35, 8.3.36, 8.4.27 or 8.5.12. Versions past end of life no longer get the project's security fixes. For a related, much smaller issue that it calls unlikely in practice, the PHP project's informational advisory of 23 October suggests turning off session upload progress until the next regular bugfix release, as our PHP2Shell explainer sets out.

Is PHP itself secure?

PHP's own manual is frank about this. Its security chapter says PHP can access files, run commands and open network connections on a server, and that "these properties make anything run on a web server insecure by default". It goes on to say that, with the right configuration options and proper coding practices, PHP can give "the combination of freedom and security you need".

So the language is a tool, and how safe a site is depends on how it's set up and kept up to date. The manual says that how secure a PHP environment is "is largely up to the PHP developer". For a personal site, that work is usually split between you, your hosting company and whoever makes your website software, such as WordPress. If you're not sure what PHP actually does on your site, our guide to what PHP is starts from the beginning.

What's the difference between the language and the version I run?

PHP comes in branches, such as 8.3 or 8.4, and each branch gets small numbered releases with fixes, such as 8.3.36. When people ask whether PHP is safe, the useful question is whether your branch is still supported and whether you have its latest release.

PHP's supported versions page says each branch is fully supported for two years from its first stable release, then gets two more years of fixes for critical security issues only. After those four years the branch reaches end of life. As of 23 October 2026, the page lists 8.2, 8.3, 8.4 and 8.5 as supported, with security support for 8.2 ending on 31 December 2026. The full table is on php.net's supported versions page.

If your site runs an older branch, our guide to options for an old PHP version covers what you can do.

Why do security updates matter so much?

Because a flaw that's been found and fixed stays open on any server that hasn't installed the fix. PHP's supported versions page describes an end of life release as one whose users "should upgrade as soon as possible, as they may be exposed to unpatched security vulnerabilities".

The UK's National Cyber Security Centre (NCSC) says the same about software in general. Its advice for individuals is that "applying security updates promptly will help protect your devices and accounts from cyber criminals", and it calls updating one of the most important and quickest things you can do. Its guidance for organisations sets the default as applying updates as soon as possible, and ideally automatically.

For a website, the update usually means PHP on the server, which your host may manage, plus the website software and plugins running on top of it. Keeping one up to date doesn't cover the other.

What does PHP2Shell show about this?

On 21 October 2026 the PHP project fixed two critical flaws, which the US agency CISA says are known as "php2shell", in new releases for the four supported branches only. The advisory says PHP 8.1 and older "no longer receive updates from the PHP project", so their owners have to rely on a vendor's backported fix or move to a supported branch. Our PHP2Shell explainer covers the flaws in full.

How do I know my site is on a supported, patched version?

Find the exact PHP version your site runs, then compare it with the supported branches and the latest fixed release for that branch. If you can't find the number yourself, your host can tell you.

Our guide on how to check your website's PHP version shows where to look in WordPress and in a hosting panel, with the questions to ask your host. If it turns out you need to change version, how to update PHP on WordPress covers that, with a backup first.

More questions

Is PHP still safe to use in 2026?

Yes, on a supported and patched version. As of 23 October 2026, PHP's supported versions page lists 8.2, 8.3, 8.4 and 8.5 as supported. Branches older than 8.2 have reached end of life, and the page says users of an unsupported release may be exposed to unpatched security vulnerabilities.

Is PHP 8.2 safe?

PHP's supported versions page shows 8.2's security support ends on 31 December 2026. Our guide to options for an old PHP version covers 8.2 and what to plan for.

Does visiting a PHP website put my computer at risk?

PHP runs on the web server, not on your device, and the PHP2Shell advisory is about installations serving web requests. Fixing them is the site owner's job. Our guide on whether visiting a hacked website can hack you covers the visitor's side.

If PHP is up to date, is my website secure?

Not on its own. PHP's manual says the security of a PHP environment also depends on its configuration and on how the code is written. Your website software, themes and plugins need their own updates, and your host is responsible for the server around them.

Who updates PHP on a hosted website?

Often your hosting company, and sometimes you through your hosting panel. The NCSC's PHP2Shell advice tells organisations to watch for updates from the vendors whose products and services bundle PHP. If you're not sure who's responsible for yours, ask your host which version your site runs and whether it has the fixed release.

Sources