Key Takeaways
- PHP 8.2 reaches end of life on December 31, 2026. After that, it gets no more security updates.
- Sites that patched PHP 8.2 for PHP2Shell are safe today but need another upgrade soon.
- The next serious PHP flaw found after December 31 will have no official fix for PHP 8.2.
- PHP 8.3 gets security fixes until 2027, PHP 8.4 until 2028, and PHP 8.5 until 2029.
- PHP 8.4 or 8.5 gives the longest runway before the next forced upgrade.
- Old plugins, themes, and custom code are what usually break during a PHP update.
- Always test a PHP update on a copy of your site before changing the live site.
If you patched PHP 8.2 for PHP2Shell, your site is protected for now. But PHP 8.2 reaches its end of life on December 31, 2026, so you will need to update to a later PHP version in about six weeks.
Think of PHP like a phone’s operating system. Once updates stop, every new security hole stays open. This guide explains the importance of this deadline and shows how to upgrade PHP without breaking your site.
What Does PHP 8.2 End of Life Mean?
PHP 8.2 end of life means the PHP Foundation will stop releasing security fixes for PHP 8.2 after December 31, 2026. Your site will continue to work, but no patches or updates will be issued for any new security flaws discovered after that date. Attackers know this and target old versions.
PHP is the software that runs your website behind the scenes. WordPress, Drupal, and most custom business apps depend on it.
Every PHP version follows the same lifecycle, listed on PHP’s supported versions page:
- Active support: About two years of bug fixes and security fixes.
- Security-only support: Two more years of security fixes only.
- End of life: No fixes at all.
PHP 8.2’s active support ended on December 31, 2024. Its security-only support ends on December 31, 2026.
Why Do Sites That Patched PHP 8.2 Need to Upgrade Again?
Sites that patched PHP 8.2 for PHP2Shell fixed one problem, but the version itself is about to expire. PHP 8.2.35 closes the PHP2Shell flaws. After December 31, the next serious flaw in PHP 8.2 will not receive a fix. Upgrading now avoids a second emergency later.
PHP2Shell showed what happens to unsupported versions. When PHP fixed the flaws on October 21, 2026, it released fixes only for supported versions. Sites on PHP 8.1 or older got no official patch.
Our guide explains what PHP2Shell is and which versions went unpatched. After December 31, PHP 8.2 joins that unprotected group.
Which PHP Version Should You Upgrade To?
Upgrade to PHP 8.4 or 8.5 if your site’s plugins and code support it. These versions get security fixes until 2028 and 2029. PHP 8.3 is the smallest step up from 8.2 and is suitable for older sites. But PHP 8.3 only receives security fixes until December 31, 2027, so you would need to upgrade again sooner.
Dates come from PHP’s supported versions page.
All three newer versions already include the PHP2Shell fix in their current releases: 8.3.36, 8.4.27, and 8.5.12.
Not sure which version you run today? Read our guide on how to check your PHP version.
How Do You Update PHP Version Safely?
To update PHP version safely, back up your site and test the new version on a staging site. Fix what breaks, then switch the live site. Never change PHP on a live business site without testing first. Most hosts let you switch PHP versions in a few clicks, and switch back just as fast.
Follow these steps in order:
- Back up everything. Save a full copy of your site files and database, stored outside your hosting account.
- Update your software. Update WordPress or your CMS to the latest PHP version first, along with all plugins and themes.
- Make a test copy. Create a staging site, which is a private copy of your site for testing.
- Switch the test copy. Change the staging site to PHP 8.4, or 8.3 if your plugins require it.
- Test critical features. Check logins, forms, search, checkout, payments, and emails.
- Fix what breaks. Update or replace broken plugins and fix custom code.
- Switch the live site. Change PHP during low-traffic hours, with a fresh backup taken that day.
- Watch closely. Check the site and error logs for the next few days.
WordPress.org’s PHP update guide recommends the same approach: back up, update, test, then switch.
On a server you manage yourself, the switch means installing new PHP packages and restarting PHP. On shared or managed hosting, you can usually update through the control panel.
What Usually Breaks When You Update PHP?
What usually breaks during a PHP update is old code, not your content. Plugins, themes, and custom features written years ago may use PHP features that newer versions removed or changed. The most common results are error messages, blank pages, broken forms, or a checkout that stops working. Testing on a copy catches these first.
Here are the usual suspects:
Don’t ignore warning messages. PHP often marks a feature as “deprecated” before removing it. Deprecated means “still works, but going away.”
Here’s a real example. PHP 8.4 flags an old way of writing optional settings in code. The PHP proposal behind that change found that 880 of the top 2,000 PHP code packages used that style. Code like this still runs on 8.4, but shows warnings until fixed.
What If Your Site Breaks After a PHP Update?
If your site breaks after a PHP update, switch back to the previous PHP version first. Most hosts let you do this in the same control panel. Then restore your backup if needed and find the plugin or code causing the problem. Treat the old version as a short-term fallback, not a permanent solution.
A safe rollback plan has three parts:
- Know how to switch back. Find the PHP version setting in your host’s panel before you upgrade.
- Keep the fresh backup. Restore it if switching back does not resolve the issue with the site.
- Find the cause. Error logs usually name the plugin or file that failed.
Then fix the cause and try again. Staying on PHP 8.2 after December 31 leaves your site without security fixes.
What If Your Site Runs PHP 8.1 or Older?
If your site runs PHP 8.1 or older, your situation is more urgent than the 8.2 deadline. These versions already get no security fixes, including for PHP2Shell. Upgrade straight to PHP 8.3 or newer rather than stopping at 8.2. The jump is bigger, so testing matters even more.
Sites running PHP 7.4 or older often require more extensive code changes. Some applications require parts to be rebuilt before they can run on modern PHP.
WordPress site owners can also read whether their WordPress site is affected, including what to ask their host.
How Can Taazaa Help You Upgrade From PHP 8.2?
Taazaa helps teams upgrade PHP without breaking the features their business depends on. For simple sites, the upgrade may take a day. For custom applications, older plugins, or many servers, it takes careful testing. Taazaa’s engineers find what will break, fix it, and move each application to a supported PHP version.
The process starts with a 48-hour review of every PHP server you run. You get a ranked plan showing which sites to upgrade first and what each one needs. If an application is too old to upgrade, Taazaa works with your team to rebuild it.
Start with a quick look at where you stand. Check your domain for free.
FAQs
When does PHP 8.2 reach end of life?
PHP 8.2 reaches end of life on December 31, 2026. After that date, the PHP project will no longer release security fixes for PHP 8.2. Your site keeps running, but new security flaws will stay unfixed. Upgrade to PHP 8.3 or newer before the deadline to stay protected.
I patched PHP 8.2 for PHP2Shell. Am I safe?
You are safe from PHP2Shell if you run PHP 8.2.35 or a patched vendor build. But PHP 8.2 will stop receiving security fixes after December 31, 2026. Any new flaw found after that date will have no official fix. Plan your upgrade to PHP 8.4 or 8.5 now.
How do I update PHP version safely?
Back up your site, update your plugins and themes, and test the new PHP version on a staging copy. Fix anything that breaks, then switch the live site during low-traffic hours. Keep a fresh backup ready. Most hosts let you switch back quickly if something goes wrong.
Which PHP version should I upgrade to from PHP 8.2?
Upgrade to PHP 8.4 if your plugins and code support it, since it gets security fixes until 2028. PHP 8.5 lasts until 2029 but suits only up-to-date sites. PHP 8.3 is the smallest step but gets security fixes only until 2027. Test whichever you choose before implementing it.
Will updating PHP break my website?
Updating PHP can break old plugins, themes, or custom code, but your content stays safe. The most common problems are error messages, broken forms, or checkout issues. Testing on a staging copy first catches these problems before visitors see them. Most hosts also let you switch back quickly.
