PHP end of life: what PHP2Shell means for PHP 7.4, 8.0 and 8.1

Is there a PHP2Shell fix for end-of-life PHP?

Not as a release. PHP’s advisory says: “PHP 8.1 and older no longer receive updates from the PHP project. Some distributions and LTS vendors provide backported fixes, so contact your vendor for details, or upgrade to a supported version.”

It continues: “Given the severity of these vulnerabilities, the PHP security team provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to help people building from source or without access to an LTS vendor.”

So there are three different things, and they shouldn’t be confused:

Which PHP versions are end of life?

Supported branches receiving the PHP2Shell fix are 8.2, 8.3, 8.4 and 8.5:

PHP 8.1, 8.0, 7.4 and everything older are end of life. PHP’s announcement also notes that PHP 8.2 reaches end of life on 31 December 2026, so a move to 8.2 is short-lived. The original research reports that at least one PHP2Shell flaw reaches back to PHP 5.4.

I’m on PHP 7.4. What should I do?

1. Find out where your PHP comes from. If your hosting provider or Linux distribution supplies it, ask them or check their security notice for a backported package.
2. If you build PHP yourself, apply the official source patch for your branch, rebuild, deploy and restart every PHP worker. Keep a record of the patch and build.
3. Plan the move to a supported branch (8.3 or newer). This is the only path that keeps receiving security fixes.

What if I’m on PHP 7.3 or older?

There is no official PHP2Shell patch for PHP 7.3 or older: PHP’s source patches cover only 7.4, 8.0 and 8.1. Unless your vendor ships a fixed package for your release, the only fix is moving to a supported branch. If you can’t do that soon, consider taking the site offline or restricting access to it, as several national agencies advise for systems that can’t be updated.

Is a version number like 7.4.33 proof that I’m vulnerable?

Not on its own. A vendor’s backported package or your own patched build keeps the 7.4 number while containing the fix. When you say PHP came from an OS package or was built from source, the PHP version checker shows “check your vendor’s patch” rather than “affected”. An unpatched upstream 7.4 build is affected.

Will upgrading from PHP 7.4 to 8.3 break my site?

It can. Major-version jumps remove old functions and change behaviour, which affects old plugins, themes and custom code. Make a full backup, test on a staging copy, update your application and plugins first, and check login, forms, payments and scheduled tasks after switching. For WordPress, see the WordPress PHP version guide.

Can I download a PHP2Shell patch installer here?

No. Use the official source downloads and backport branches linked from PHP’s announcement. How you apply them depends on your build, extensions and deployment, so there’s no universal installer. If you’d rather not build PHP yourself, use a vendor package or move to a supported release.

How do I prove a custom PHP build is patched?

Record the source revision, the backport branch you applied, the build date and where it was deployed. Then confirm the website actually runs the new build after restarting workers; php -v on the command line may still point at another binary. See the check PHP version guide and return to the PHP2Shell checker for the overview.

Which sources support this page?

• The PHP Group: security advisory
• The PHP Group: supported versions
• The PHP Group: downloads
• PHP manual: installation on Unix systems
• Wiz Research: original research
• Canonical: Ubuntu security notice