upgrading your php version: everything below php 8.2 is now open to attack

why did so many companies have to switch their systems off?

Because on 21 October they had two options, and both were lousy. Either keep the system online, with a vulnerability that lets strangers take over the server without a password. Severity 9.2 out of 10. Or pull the plug. Many pulled the plug, cinemas with their booking systems for example.

An update would have prevented that. But nothing below PHP 8.2 gets official updates any more. And moving old software to a newer version is not a click, it is a risk. Every PHP version cleans up: ways of writing code that worked for years suddenly cause errors, old functions behave differently or disappear. Software that various people have written over the years trips over this in a hundred places.

Then there is the real problem: with many older systems there is nobody left who knows the code. The developer has moved on, the agency no longer exists. So nobody dares to switch the version. Until a vulnerability like PHP2Shell makes the decision for you.

what does a day offline cost you?

Work it out for your business. A booking system that is unreachable for an evening costs every booking of that evening. A shop that is offline sells nothing. Add the customers who go to a competitor and stay there, the calls your team answers instead of doing their actual work, and the impression it leaves.

And that is the good case. The bad one is that the system stays online and someone uses the vulnerability. Then it is no longer about one evening’s revenue, but about stolen customer data, a report to the data protection authority and a back door that may still be open weeks later.

Compared to that, a planned upgrade is cheap. It costs money once, but it happens when you decide. Not when the authorities sound the alarm.

how long is your php version still safe?

Every PHP version gets two years of new features and then two more years of security updates. After that it is over, and every new vulnerability stays open. The dates are on php.net.

Jumping from 8.1 to 8.2 today means facing the same question again in just over two months. If changes are needed anyway, going to 8.3 or 8.4 is usually hardly more work, and 8.4 buys you just over two years of peace.

and if you are still on php 8.0, 7 or even 5?

Then you are in real trouble. PHP 8.0 has had no updates since November 2023, PHP 7.4 since November 2022. For PHP2Shell those two only got makeshift fixes to build in yourself. For PHP 7.3 and everything below there is nothing at all. No fix, not even a makeshift one. The door stays open.

And this is not about a few exotic cases. According to W3Techs, 27 percent of all PHP websites still run on PHP 7 and 7.7 percent even on PHP 5. Together that is a good third. According to the researchers the vulnerability has been in the code since PHP 5.4.

On top of that, the jump from PHP 7 to 8 is the biggest in years. More changed there than between 8.1 and 8.3. The longer software sits on an old version, the more needs adapting when it moves. It is still doable, usually without a rebuild.

how we move your software to a safe php version

We have already helped companies move their code from PHP 8.1 to a newer version. No rebuild, and without taking the live system offline for it. This is how it works.

• Code check. Special checking tools find every spot that causes trouble. We look at the tricky parts ourselves. Afterwards you know exactly what needs doing and get a fixed price.
• A copy on the new version. We build a test environment that looks exactly like your live system, just with the new PHP version. Your live system keeps running unchanged in the meantime.
• Adapt and test. We fix every spot we found and run through the key processes: booking, paying, forms, emails. Only once everything runs cleanly do we move on.
• Switch over. It only takes minutes. The old version stays ready in case we need to go back.

an update alone is not enough

A current PHP version shuts the door. But whoever was already inside stays inside. That is exactly what the authorities are warning about after PHP2Shell: attackers leave back doors to return later, even after the update.

That is why with every upgrade we also look at the server: is the operating system up to date, who has access, with which permissions does the software run. Where needed, we adapt the infrastructure and harden it.

And we set up monitoring that we run by default for most of our clients anyway. It reports automatically when code changes on the server or new files appear. A planted back door gets noticed before anyone uses it.

while others had to switch off, our clients kept running

We build our own projects with Next.js, and the booking software and CRM systems we run do not use PHP either. On 21 October none of them were affected and none had to go offline. What happened that day is in our article PHP2Shell: the security vulnerability that can take over your website.

We still know PHP inside out, from WordPress, Shopware and many systems we have taken over. And from exactly those projects we know: old PHP software almost never needs rebuilding. Someone just finally has to touch it.

check these four things today

• Which PHP version is running? Your host shows it in the customer panel, usually under settings or PHP. If it shows a version below 8.2, your software is open to attack. If it shows 8.2 or higher, ask whether the 21 October update is installed.
• Who knows the code? Is anyone still around who built the software and can change it?
• Is there a current backup, and has it ever been restored?
• Would anyone notice if new files appeared on the server?

• php.net: Supported Versions
• php.net: Security advisory PHP2Shell, 21 Oct 2026
• php.net: Migrating from PHP 8.1 to 8.2, deprecated features
• php.net: Migrating from PHP 8.2 to 8.3, incompatible changes
• CERT.at: Critical vulnerabilities in PHP
• NCSC UK: Critical security issue affecting PHP
• W3Techs: PHP 8 versions

As of 21 October 2026. We calculated the share of websites without an official update from the W3Techs version figures.