Running PHP 8.1 or older? Your options after PHP2Shell

PHP 8.1 reached end of life on 31 December 2025, according to the PHP project's list of unsupported branches, and its last release was 8.1.34. When the project fixed two critical flaws on 21 October 2026, it released no new version for 8.1 or anything older. This guide is accurate as of 23 October 2026.

Which PHP versions still get security fixes?

The PHP project's supported versions page lists four branches. Each one is "fully supported for two years from its initial stable release", then supported "for two additional years for critical security issues only". After that, the page says, "the branch reaches its end of life and is no longer supported."

When did PHP 8.1, 8.0 and 7.4 reach end of life?

The PHP project's page of unsupported branches gives these dates and final releases:

• PHP 8.1: 31 December 2025, last release 8.1.34
• PHP 8.0: 26 November 2023, last release 8.0.30
• PHP 7.4: 28 November 2022, last release 7.4.33

The same project defines end of life plainly. Its supported versions page says users of an end of life release "should upgrade as soon as possible, as they may be exposed to unpatched security vulnerabilities."

What does the 21 October advisory say about old versions?

It says "PHP 8.1 and older no longer receive updates from the PHP project." It goes on: "Some distributions and LTS vendors provide backported fixes, so contact your vendor for details, or upgrade to a supported version." LTS stands for long-term support, and a backported fix is the security repair copied onto an older version.

The advisory also says that, "given the severity of these vulnerabilities", the PHP security team published minimal source backports for PHP 7.4, 8.0 and 8.1. It says these are "to help people building from source or without access to an LTS vendor". The advisory lists no new 7.4, 8.0 or 8.1 release.

The fixed releases for supported branches are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. How to check your website's PHP version shows how to find yours and compare it.

The US Cybersecurity and Infrastructure Security Agency (CISA) is blunter about old versions. Its alert says organisations that can't update immediately, "or that continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated."

Is PHP 8.2 safe, and when does it end?

PHP 8.2.35 is the fixed release for the 8.2 branch. Its release notice on php.net adds a warning: "PHP 8.2 reaches end of life on 31 December 2026 and will receive no further security fixes after that date. Please plan your upgrade to a supported version."

So a site on 8.2.35 has the fix for the two 21 October flaws, but has about ten weeks left of security fixes from the project. If you're moving off 8.1 now, going straight to 8.3 or newer saves doing it twice. WordPress's own page on updating PHP recommends 8.3 or higher.

What are my options if my site is on an old version?

For a blog, a club site or a small shop, the work usually splits between you and your hosting company.

1. Ask your host two questions. Which PHP version is my site on? And, if it's 8.1 or older, has a backported fix for CVE-2026-109618 and CVE-2026-109619 been applied to it? The PHP advisory points people on old versions to their vendor for this. On hosted sites, that question goes to your host.
2. Get the site ready to move. WordPress's guidance before changing PHP is to make a backup, then update WordPress, themes and plugins from Dashboard > Updates, and check the site still works. It says WordPress itself runs on PHP as far back as 7.4, "but we don't know if your themes or plugins will work on newer versions." Our guide on how to update PHP on WordPress goes through these steps in order. If you use a different CMS, its own documentation is the place to check which PHP versions it supports.
3. Move to a supported version. Once the site is up to date, ask the host to switch it, or switch it yourself if your panel allows. The NCSC's PHP news item says "Organisations using older versions of PHP are highly encouraged to update to a fully supported version."

If none of that can happen quickly, CISA's advice above is to take the site offline until it can be patched or updated.

What does the NCSC say about unsupported software?

The NCSC's guidance on obsolete products starts from the point that "All software, including device operating systems, will eventually become out of date." It says that when developers stop providing security updates, this "increases the likelihood that exploitable vulnerabilities will become known by attackers", and that over time new ones "can be exploited by relatively low-skilled attackers".

Its position on what to do is clear: "The only fully effective way to mitigate this risk is to stop using the obsolete product." It accepts that this isn't always possible straight away, and says "the NCSC would recommend upgrading instead of continuing at risk". If you do carry on for a short time, it says to revisit that decision regularly. For a website on PHP 8.1 or older, that points to the same answer as the PHP project: a supported version.

More questions

Is PHP 7.4 affected by PHP2Shell?

The NCSC says organisations using any version of PHP are affected, and the PHP security team published a minimal source backport for 7.4 because of how severe the flaws are. There's no new official 7.4 release. Ask your host whether they've applied a backported fix, and plan to move to a supported version.

My host says it has backported the fix to PHP 8.1. Is that enough?

The PHP advisory says some distributions and LTS vendors provide backported fixes and that you should check with them, so your host is the one to confirm it. The branch is still past end of life, though, and the NCSC's guidance on obsolete products recommends upgrading rather than continuing at risk.

Will moving to a newer PHP version break my site?

It might, which is why the order matters. WordPress says updating PHP "should not be a problem, but we can't guarantee that it's not", and asks you to back up and update themes and plugins first. WordPress notes that to restore a backup you'd also need your host to move PHP back to the version you're on now.

What happens to PHP 8.2 after 31 December 2026?

The PHP project says 8.2 will receive no further security fixes after that date and asks users to plan an upgrade to a supported version. A site on 8.2 then joins 8.1 and older as unsupported.

Sources

• Supported versions, PHP
• Unsupported branches, PHP
• Security advisory: Critical remote code execution vulnerabilities, update now, and the PHP 8.2.35 release notice, PHP (21 Oct 2026)
• Critical security issue affecting PHP, NCSC
• Obsolete products, NCSC device security guidance
• Critical vulnerabilities in PHP require immediate patching, CISA
• Update PHP, WordPress.org