Living page · updated as PHP changes

Which PHP version should your site be on? 8.4 or 8.5, patched.

PHP is the language most self-hosted sites run on, including WordPress. On 21 October 2026 it got an urgent security fix, and PHP 8.2 stops getting fixes on 31 December 2026. Here's which version to run, how to check yours, and how to switch safely.

Not sure which PHP you run? Chat now WhatsApp +92 326 2326191

Last updated 25 October 2026Written by the Penguina teamNo forms, no card

The short answer

Run PHP 8.4 or 8.5, with the 21 October fix in.

Checked on 23 October 2026

1. On 8.1 or older: upgrade now. It gets no security fixes at all.

2. On 8.2: patch today, then move to 8.4 or 8.5 before 31 December 2026.

3. On 8.3, 8.4 or 8.5: make sure the 21 October 2026 security fix is in. Hold off on 8.6 for now.

This page is for owners of self-hosted sites (WordPress, WooCommerce, Joomla, Drupal or custom PHP) on shared, managed or VPS hosting, in the US, UK, Canada and Australia.

On a hosted platform?

On Shopify, Wix, Squarespace or Webflow? The platform handles PHP and server updates for you, so there's nothing to change.

You can stop reading here. The rest of your site still needs looking after: what we look after on any website, safe updates and security and spam blocking.

Every version at a glance

Which PHP versions are still supported?

"Active support" means bug fixes and security fixes. "Security only" means just the security fixes. After that, a version gets nothing.

Version	Status today	Supported until	What to do
PHP 8.6	Not released yet. Planned for 19 November 2026, and plans can move.	Not set yet	Wait. Why
PHP 8.5	Active support	Active to 31 December 2027, security to 31 December 2029	Good choice. Be on 8.5.12 or a patched build.
PHP 8.4	Active support	Active to 31 December 2026, security to 31 December 2028	Good choice. Be on 8.4.27 or a patched build.
PHP 8.3	Security only	31 December 2027	Patch to 8.3.36, then plan a move to 8.4 or 8.5.
PHP 8.2	Security only, ending soon	31 December 2026	Patch to 8.2.35 today. Move before 31 December. More
PHP 8.1 and older	No support (8.1 ended 31 December 2025)	Already ended	Upgrade now. No fix is coming for these.

Dates from php.net's supported versions page. If your site runs WordPress, also check WordPress's requirements page for the version it currently recommends. As of 23 October 2026 it says “PHP version 8.3 or greater”.

The 21 October 2026 flaw

Is my site affected by the new PHP flaw?

If it runs PHP and hasn't had the 21 October 2026 fix yet, yes. Here's what happened, in plain words.

What

Two critical flaws

CVE-2026-109618 and CVE-2026-109619 can let an attacker run their own code on a server without logging in. Both are rated 9.2 out of 10 (CVSS).

Who

Almost every version

Every PHP version before the fixed releases is affected, back to at least 5.4.

Fix

Fixed releases

8.5.12, 8.4.27, 8.3.36 and 8.2.35, out 21 October 2026. There's no full workaround: updating is the only safe choice.

The question we hear most

"My site still says 8.5.11. Am I patched?"

Maybe, yes. Some hosts and Linux systems add security fixes to the version you already run, without changing the number. That's called backporting. Hostinger, for example, says the fix "is built into the PHP version your site already runs, so the version number may not change."

So the version number alone doesn't tell you. The build date does, or your host does.

Find your version
See how to check below.
Below 8.5.12, 8.4.27, 8.3.36 or 8.2.35?
That isn't automatically unsafe. Look up the PHP build date in your host panel's PHP info screen.
Build date 21 October 2026 or later
Probably patched. The fix is likely in.
Older date, or you can't tell
Ask your host in writing: "Is the fix for CVE-2026-109618 and CVE-2026-109619 applied to my PHP build?"

Hostinger managed plans

Check the build date

Hostinger dashboard → Websites → Dashboard → PHP Info. Hostinger says a Build Date of 21 October 2026 or later means the fix is in, and that rollout finished on 22 October 2026 on every plan except VPS.

Debian or Ubuntu servers

Check the package, not the number

The proof is the package changelog, or the exact package version compared with the security advisory. Not the "8.x.y" number.

VPS or self-managed

Patch it yourself

Update the PHP packages and restart PHP. Only updating fixes CVE-2026-109618 and CVE-2026-109619 (PHP2Shell); no php.ini setting stops them.

Separate flaw: on 23 October 2026 php.net warned about CVE-2026-115560 (session upload progress). 8.5.12, 8.4.27, 8.3.36 and 8.2.35 do not fix it, and as of 25 October 2026 no fix is out. Until one is, php.net's workaround is “session.upload_progress.enabled = 0”, then restart PHP workers.

One safety note: never leave a public PHP info page on your site. It tells attackers exactly what you run. View it inside your host panel only.

How to check

Which PHP version am I on?

It takes a minute. You don't need to touch any code.

If your site runs WordPress
Log in, then go to Tools → Site Health → Info → Server. The PHP version is listed there. You want 8.4 or 8.5, patched.
Any other site
Open your hosting panel. The PHP version is usually under "PHP configuration", "Select PHP Version", "MultiPHP Manager" or "PHP settings".
Check the build date
In the same panel, open the PHP info screen and look for the build date. 21 October 2026 or later is a good sign.
Can't find it?
Ask your host which PHP version and build your site runs, and whether the 21 October 2026 fix is applied. Or send us your address.

How to switch safely

Will upgrading PHP break my site?

It can, if an old plugin, theme or custom code doesn't support the new version. That's why every route below follows the same order.

Back upFiles and database
Test on a copyA staging site, if your host has one
SwitchChange the version in your panel
TestKey pages, forms, bookings, checkout
Keep the way backSwitch back if errors appear

Managed WordPress hosting

Usually patched for you

Check the version in Site Health and confirm the patch level with your host. Still old after 48 hours? Open a ticket and ask: "Is the fix for CVE-2026-109618 and CVE-2026-109619 applied to my PHP build?"

cPanel shared hosting

Select PHP Version or MultiPHP Manager

Back up first, switch, then test your key pages and forms. If errors appear, switch back.

hPanel (Hostinger) and other panels

PHP configuration

Open your website in the panel, then its PHP configuration. Same order: back up, switch, test.

Plesk

Domains → PHP settings

Pick the version for your domain, save, then test. Keep the old version noted so you can switch back.

VPS or self-managed

Update the packages

Install your system's PHP security updates and restart PHP-FPM. System package lists can lag behind, so check the fix actually landed.

Shopify, Wix, Squarespace, Webflow

Nothing to do

The platform runs and patches the server software for you, including PHP where it uses it. There's nothing for you to switch.

How do I roll back? Switch the PHP version back in the same panel screen. If the site still has errors, restore the backup you made before switching.

PHP 8.6

Should I move to PHP 8.6?

Not on day one. PHP 8.6.0 is planned for 19 November 2026, and plans can move. Wait until your key plugins, theme and any custom code say they support it, then switch with the same back-up-and-test steps.

Planned for 19 November 2026: PHP 8.6.0 release. We'll update the table on this page once it actually ships.

31 December 2026

What happens after 31 December if I stay on PHP 8.2?

Your site won't switch off. But PHP 8.2 stops getting security fixes, so the next flaw like the 21 October one won't be fixed for it.

Today8.2 patched

Update to 8.2.35 while 8.2 still gets security fixes.

31 December 20268.2 ends

No more security fixes for 8.2. 8.4 moves to security fixes only.

31 December 20278.3 ends

No more security fixes for 8.3.

31 December 20288.4 ends

No more security fixes for 8.4.

On PHP 8.1 or older? It has had no security fixes since 31 December 2025. Upgrade now, don't wait for these dates.

What it costs

Your first fix is free. Then from $100 a month.

Your first fix, free

Send us your website. We'll check which PHP it runs.

Your first fix is free, before you pay a cent. We look after any website, on any platform.

We check the version, the build and the patch
Plain-words note of what we found
No call needed, no forms, no card

Check my PHP, free

To keep it current

Every plan, every month.

Keep: hosting we look after, with the security certificate (the padlock) renewed automatically$100 / month

Grow: everything in Keep, plus fixes where visitors give up$250 / month

Full Care: everything in Grow, plus new pages and answers$500 / month

Setup fee$0

Month to month, and everything stays in your name. Prices in US dollars. See every plan

Is there a contract? No. Every plan is month to month: cancel any month, keep everything, and pay $0 setup.

Questions

Questions owners ask.

Something else? Ask in the chat, email hello@penguina.website or WhatsApp us.

Which PHP version should my site be on?

PHP 8.4 or 8.5, with the 21 October 2026 security fix in. If you're on 8.2, patch it now and move before 31 December 2026, when 8.2 stops getting security fixes. If you're on 8.1 or older, upgrade now.

Which PHP version am I on, and how do I check?

If your site runs WordPress, go to Tools → Site Health → Info → Server. Otherwise, open your hosting panel and look under PHP configuration, Select PHP Version, MultiPHP Manager or PHP settings. Or ask your host.

Is my site at risk from the new PHP flaw?

If it runs PHP and doesn't have the 21 October 2026 fix yet, yes. Two critical flaws (CVE-2026-109618 and CVE-2026-109619, both rated 9.2) can let an attacker run code on the server without logging in. The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and updating is the only safe choice.

My site still says 8.5.11. Am I patched?

Maybe. Some hosts add the fix to the version you already run without changing the number. Check the PHP build date in your host panel: 21 October 2026 or later is a good sign. If it's older or you can't tell, ask your host in writing whether the fix for CVE-2026-109618 and CVE-2026-109619 is applied to your PHP build.

Will upgrading PHP break my site?

It can, if an old plugin, theme or custom code doesn't support the new version. Back up first, test on a copy if your host offers one, switch, test your key pages and forms, and switch back if errors appear.

I'm on Shopify, Wix, Squarespace or Webflow. Do I need to do anything?

No. The platform handles PHP and server updates for you, so there's nothing to change. We still look after the rest of your site, on any platform: see what we look after.

What happens after 31 December 2026 if I stay on PHP 8.2?

Your site keeps working, but PHP 8.2 stops getting security fixes. The next serious flaw won't be fixed for it. Move to 8.4 or 8.5 before then.

Should I move to PHP 8.6?

Not on day one. PHP 8.6.0 is planned for 19 November 2026, and plans can move. Wait until your key plugins, theme and custom code confirm support, then switch with the same back-up-and-test steps.

Does my host do this for me?

Often, on managed hosting, the host applies security fixes for you. Switching to a newer PHP version (for example from 8.2 to 8.4) is usually up to you. On a VPS or self-managed server, both are up to you. If you're not sure, ask your host.

How do I roll back a PHP upgrade?

Switch the PHP version back in the same panel screen you used to change it. If the site still has errors, restore the backup you made before switching.

Is there a contract?

No. Every plan is month to month: cancel any month, keep everything, and pay $0 setup. See "Is there a contract?" on our pricing page.

Help when something goes wrong.

Red warningMy website was hacked UpdatesSafe updates, tested on a copy first BackupsBackups we check actually work PadlockMy website says "Not secure" Locked outMy developer disappeared CostWhat website care costs

Sources for this page

Which PHP version should your site be on? 8.4 or 8.5, patched.

Run PHP 8.4 or 8.5, with the 21 October fix in.

On Shopify, Wix, Squarespace or Webflow? The platform handles PHP and server updates for you, so there's nothing to change.

Which PHP versions are still supported?

Is my site affected by the new PHP flaw?

Two critical flaws

Almost every version

Fixed releases

"My site still says 8.5.11. Am I patched?"

Find your version

Below 8.5.12, 8.4.27, 8.3.36 or 8.2.35?

Build date 21 October 2026 or later

Older date, or you can't tell

Check the build date

Check the package, not the number

Patch it yourself

Which PHP version am I on?

If your site runs WordPress

Any other site

Check the build date

Can't find it?

Will upgrading PHP break my site?

Usually patched for you

Select PHP Version or MultiPHP Manager

PHP configuration

Domains → PHP settings

Update the packages

Nothing to do

Should I move to PHP 8.6?

What happens after 31 December if I stay on PHP 8.2?

Your first fix is free. Then from $100 a month.

Send us your website. We'll check which PHP it runs.

Every plan, every month.

Questions owners ask.

Help when something goes wrong.