PHP versions
Which PHP version is your site running?
The latest is PHP 8.5.12. Versions 8.5, 8.4, 8.3 and 8.2 are supported and have a fix for PHP2Shell. Everything from 8.1 down has no fixed release, and anything older than 8.2 gets no security fixes at all.
Not sure what your site runs? Find out free, in under a minute.
Where you stand, by version.
A fixed build exists.
You need 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or newer, and PHP has to be restarted so the new build is the one serving your site.
Fixed, but not for long.
Security fixes for 8.2 end on 31 Dec 2026. After that, the next flaw has no official fix. Plan the move to 8.3 or newer.
No release. A source patch only.
PHP published minimal source patches, but no fixed release. Your site is only fixed if your host or distribution applied one. Otherwise, upgrade.
Exposed, with no fix at all.
These versions are inside the reported affected range (5.4 to 8.5) and neither a release nor a patch covers them. Move to a supported version.
Supported PHP versions
| Version | Latest release | First released | Bug fixes until | Security fixes until | Status | PHP2Shell |
|---|---|---|---|---|---|---|
| PHP 8.5 | 8.5.12 | 20 Nov 2025 | 31 Dec 2027 | 31 Dec 2029 | Fully supported | Fixed in 8.5.12 |
| PHP 8.4 | 8.4.27 | 21 Nov 2024 | 31 Dec 2026 | 31 Dec 2028 | Fully supported | Fixed in 8.4.27 |
| PHP 8.3 | 8.3.36 | 23 Nov 2023 | 31 Dec 2025 | 31 Dec 2027 | Security fixes only | Fixed in 8.3.36 |
| PHP 8.2 | 8.2.35 | 8 Dec 2022 | 31 Dec 2024 | 31 Dec 2026 | Security fixes only, ends 31 Dec 2026 | Fixed in 8.2.35 |
Each version gets two years of bug fixes, then two more years of security fixes only, ending on 31 December.
End-of-life PHP versions
No new security fixes, ever. Every flaw found in these versions stays open. PHP2Shell is reported to affect versions 5.4 to 8.5, so all of the below are inside the affected range.
| Version | Last release | End of life | PHP2Shell |
|---|---|---|---|
| PHP 8.1 | 8.1.34 | 31 Dec 2025 | Source patch only |
| PHP 8.0 | 8.0.30 | 26 Nov 2023 | Source patch only |
| PHP 7.4 | 7.4.33 | 28 Nov 2022 | Source patch only |
| PHP 7.3 | 7.3.33 | 6 Dec 2021 | No fix |
| PHP 7.2 | 7.2.34 | 30 Nov 2020 | No fix |
| PHP 7.1 | 7.1.33 | 1 Dec 2019 | No fix |
| PHP 7.0 | 7.0.33 | 10 Jan 2019 | No fix |
| PHP 5.6 | 5.6.40 | 31 Dec 2018 | No fix |
| PHP 5.5 | 5.5.38 | 21 Jul 2016 | No fix |
| PHP 5.4 | 5.4.45 | 3 Sep 2015 | No fix |
“Source patch only” means PHP published minimal source patches for 7.4 to 8.1 but no fixed release, so a build is only fixed if your host or distribution applied one. Some summaries list these as “no fix”. Versions 5.3 and older are also end-of-life, and fall outside the reported affected range.
A version number can mislead
Linux distributions such as Ubuntu, Debian and the Red Hat family can apply a fix without changing the number. An “old” 8.1 may be fixed, and a “new” number can still be running old code until PHP is restarted. The number is a clue, not proof.
Check guideHow to find your version
- Free scan: type your address above. It shows the version your server reports.
- Hosting control panel: look for a “PHP version” setting.
- WordPress: Tools, then Site Health, then Info, then Server.
- Developer or server admin: ask them to run
php -v.