Security · IHS Blog
PHP 8.1 and older are end of life: what that means for your website
Every PHP branch gets about two years of active support and then security-only fixes, after which it reaches end of life. The PHP project lists current support dates on php.net. PHP 8.1 and everything older are past end of life.
Why it matters this month
For PHP2Shell, official fixed releases shipped for 8.5, 8.4, 8.3 and 8.2. Google Cloud reports the PHP project is not releasing fixes for 8.1 or earlier. SecurityWeek reports minimal source-code backports were published for 7.4, 8.0 and 8.1, which a host would have to apply itself. Either way, an end-of-life PHP depends on your host doing extra work.
Moving up safely
- Take a full backup of files and database.
- Update WordPress, theme and plugins first.
- Check each plugin's stated PHP compatibility; remove ones that are abandoned.
- Switch PHP on a staging copy, test forms, checkout and booking flows, then switch live.
Or leave PHP behind
If your site is mostly pages, menus and forms, a static HTML site removes the PHP upgrade treadmill. We convert WordPress sites to HTML for free.
Questions
Will my host patch PHP 8.1 for PHP2Shell?
Some hosts backport fixes, but the PHP project's official fixed releases are for 8.2 and newer. Ask your host what they did for CVE-2026-109618 and CVE-2026-109619.
Want off WordPress? We convert WordPress sites to fast, secure static HTML on our platform for free, and keep your URLs and Google rankings intact.