PHP upgrade
Is your PHP still getting security fixes?
In short: two critical PHP vulnerabilities were fixed on 21 October 2026, and PHP 8.2 reaches end of life on 31 December 2026, when its security fixes stop. If your site or app runs on PHP 8.2 or older, I'll tell you for free how hard the move to a supported version is and what it would take.
What happened
On 21 October 2026 the PHP team released fixes for two critical vulnerabilities, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). They let an attacker run code on a web server without logging in, and security firms have reported attacks using them. Changing PHP settings doesn't fully protect you; only the fixed versions do: 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or a patched package from your Linux distribution, which may keep an older version number.
PHP 8.1 and older no longer get regular releases. For 7.4, 8.0 and 8.1, the PHP team published only minimal source patches, which hosting providers may be slow to ship; PHP 7.3 and older got no official fix at all. PHP 8.2 still gets security fixes, but only until its end of life on 31 December 2026; after that, the next critical bug in 8.2 won't be fixed in official releases.
PHP end of life dates: what to do, by version
| Your PHP version | Security fixes until | What to do |
|---|---|---|
| 8.5 | 31 Dec 2029 | Make sure you're on 8.5.12 or newer. Your host may have done it already. |
| 8.4 | 31 Dec 2028 | Make sure you're on 8.4.27 or newer. |
| 8.3 | 31 Dec 2027 | Make sure you're on 8.3.36 or newer, and plan the move to 8.4 or 8.5 within a year. |
| 8.2 | 31 Dec 2026 | Update to 8.2.35 now, and move to 8.4 or 8.5 before the end of the year. |
| 8.1 or older | Ended | Move to a supported version. Until then, ask your host whether their PHP build includes the October fixes; for 7.3 and older there is no official patch. |
Not sure which version you run? Your hosting control panel usually shows it, or ask your developer. If your PHP comes from Ubuntu, Debian or Red Hat packages, the version number may stay the same after the fix: ask your host or check your distribution's security notice. If you're on 8.3 or newer, the patch is usually all you need, and you don't need me for it.
On WordPress? Updating WordPress or its plugins doesn't fix PHP2Shell: the flaw is in PHP itself, so the fix comes from whoever runs your PHP, usually your host. You can see your PHP version in WordPress under Tools → Site Health → Info → Server.
What makes an upgrade hard
Moving from PHP 8.2 to 8.4 is often a small job. From PHP 7 it can be much bigger. It depends on:
- the framework: older Laravel or Symfony versions don't support newer PHP, so the framework has to be upgraded as well;
- Composer packages that are no longer updated;
- WordPress plugins and themes, or PrestaShop modules, that nobody maintains any more;
- your own code using features that newer PHP removed or changed;
- tests: without them, every change has to be checked by hand.
Free upgrade estimate
I look at your system for free, find out how hard the move is and give you an estimate. No obligation.
- What I need
- Your PHP version and hosting. If your project uses Composer: the files
composer.jsonandcomposer.lock. For WordPress: the WordPress version, the theme and the plugin list with versions. For PrestaShop: the version and the module list with versions. If that isn't enough, read-only access to your company's code repository on GitHub, GitLab or Bitbucket, removed afterwards. - What you get
- Within 2 working days of getting the files: whether the move is simple, moderate or hard, what blocks it, which version to move to, and an estimate in days.
- Price
- Free, for one site or application. No obligation to hire me for the upgrade.
- What I don't touch
- Your live site, database and servers: I don't scan or test them. Please don't send passwords, keys or customer data.
This is an estimate, not a security audit. If you also want to know where your app could lose money or leak data, that's the one-day critical audit (€600 excl. VAT).
If you want me to do the upgrade
You get a fixed price before any work starts. I upgrade PHP and the packages that need it, fix the code, check the main flows on a test copy before release, and keep a way to roll back. No audit is needed for the upgrade alone: the price is based on the estimate. After that, monthly maintenance from €250/month excl. VAT applies security fixes and minor updates as they come out, and tells you well before your PHP version stops getting security fixes.
WhatsApp @twofed: messages only, in English. Files are easier by email. How I handle your data
Sources
- PHP security releases, 21 October 2026 (php.net)
- PHP: Supported versions (php.net)
- PHP2Shell: critical vulnerabilities in PHP (Datadog Security Labs)
- PHP2Shell: critical PHP vulnerabilities patched (Help Net Security)
Facts as of 26 October 2026