In this article
Last checked October 21, 2026, at 10 p.m. Eastern.
If WordPress Site Health shows PHP 7.4, 8.0 or 8.1, the PHP project won’t be releasing a PHP2Shell fix for your version. It stopped supporting PHP 8.1 and everything older before these flaws were found. That doesn’t mean you’re out of options. It means the fix has to come from somewhere other than PHP itself, or you need to move to a version that still gets updates.
A site built around 2019 and left alone since is very likely on PHP 7.4, because that was the standard version then. Plenty of Tampa Bay service businesses are in exactly that spot: a site that was a one-time project, still working, never upgraded. This week is the week to deal with it.
New to PHP2Shell? Our plain-English guide covers what it is and how to check your version.
Is there a fix for PHP 7.4, 8.0 or 8.1?
Not from the PHP project in a form most sites can use. PHP published minimal source-code patches for 7.4, 8.0 and 8.1, but no official releases, so someone has to build and ship them. Several hosts and Linux vendors are doing exactly that, and if your host is one of them, your old version can be patched without an upgrade.
Vendors shipping fixes for old PHP this week include:
- cPanel, which backported the fix into its ea-php74, ea-php80 and ea-php81 packages on October 21
- CloudLinux, whose packages sit under a lot of shared hosting, with fixed builds for PHP 5.2 through 8.5 on most of its platforms
- TuxCare, a paid extended-support service, which says 7.4 builds are out on nearly every Linux platform it supports
- Ubuntu 22.04, whose built-in PHP 8.1 is fixed under standard support. Ubuntu 20.04 and older need a paid Ubuntu Pro subscription
- Hosts such as Hostinger, Pantheon and Liquid Web, which say they’re patching older versions too
If you’re on shared hosting, ask your host whether your old version is covered and when. Our host-by-host table shows what each one has said so far.
Should I just upgrade instead?
Yes, if you can do it in the next few days. A vendor patch closes PHP2Shell, but your version still won’t get fixes for whatever comes next. Upgrading solves both problems. Aim for PHP 8.3, 8.4 or 8.5. Skip 8.2: its security support ends December 31, 2026, ten weeks from now.
| PHP version | Security fixes until |
|---|---|
| 8.5 | December 31, 2029 |
| 8.4 | December 31, 2028 |
| 8.3 | December 31, 2027 |
| 8.2 | December 31, 2026 |
| 8.1 and older | Already ended |
The catch is that a jump from 7.4 to 8.3 crosses several versions of changes. PHP 8.0 removed old functions that some plugins and custom themes still call, and later versions got stricter about code that used to slide by. A site that breaks usually shows WordPress’s “There has been a critical error on this website” message, and the admin email gets a recovery link.
How do I upgrade PHP without breaking my WordPress site?
Upgrade on a copy first, then the real site. Most hosts offer a one-click staging copy. If yours doesn’t, a full backup you’ve actually tested is the minimum.
The order that keeps surprises small:
- Take a full backup of files and database, and know how to restore it.
- Update WordPress, every plugin and your theme while you’re still on the old PHP. Current versions are far more likely to support new PHP.
- Remove plugins you don’t use. Each one is a chance to break, and abandoned plugins are the usual culprits.
- Switch PHP on the staging copy and test what makes you money: forms, checkout, booking, logins, search.
- Check the error log for warnings even if pages look fine.
- Switch the live site, then watch it for a day.
If one plugin refuses to work on new PHP and hasn’t been updated in years, replace it. Holding the whole site on unsupported PHP for one plugin is a bad trade.
What if I can’t upgrade or get a patch this week?
Then the advice from CISA is blunt: take PHP sites on 8.1 or older offline until they’re patched or upgraded. WordPress.org repeats the UK National Cyber Security Centre’s advice to consider taking self-managed servers offline in the same situation.
Offline means the server stops running PHP for the site. A maintenance-mode plugin isn’t enough, because it still runs PHP on every request. Ask your host to disable PHP for the site or serve a static holding page, keep your phone number and hours current on your Google Business Profile, and pause any ads pointing at the site.
Can OJ Amplify do the upgrade for us?
Yes, and we can start right away. We take a backup, build a staging copy, update WordPress and the plugins, move PHP to a supported version, test the parts of the site that earn money, then switch the live site and watch it. If a plugin can’t make the jump, we’ll tell you plainly and replace it. It’s the same work our WordPress development team does on sites we didn’t build.
Call 813-531-9400 and we’ll pick up. If you’d like this handled every month going forward, our website care plans keep PHP, WordPress and plugins current so you’re never this far behind again.
Common questions
How long does a PHP upgrade take? For a typical small business WordPress site with current plugins, it’s often quick. Sites with old page builders, custom theme code or abandoned plugins take longer, because those pieces need fixing or replacing first.
Is PHP 8.2 safe to use right now? It’s patched in 8.2.35, so yes for now. But it stops getting security fixes on December 31, 2026, so if you’re upgrading anyway, skip straight to 8.3 or newer.
My host patched PHP 7.4 for me. Can I stay on it? For PHP2Shell, you’re covered. For anything discovered after this, you’re relying on your host to keep backporting. Plan the upgrade for the next few weeks rather than the next few years.