Outdated PHP version: Why end-of-life puts your website at risk

An outdated PHP version is one of the biggest security risks for websites. According to the BSI, all PHP versions before 8.2 have reached end of life; PHP 8.2 will only receive security updates until the end of 2026. For versions without support, there are at most emergency patches for new vulnerabilities such as PHP2Shell, and none at all for very old versions. Operators should therefore upgrade to PHP 8.3 or newer.

What end of life means

Each PHP version is maintained only for a limited time: first with bug fixes and security updates, then for a while with security updates only. After that, support ends. New vulnerabilities remain open, and attackers know this. According to the BSI, search engines for connected systems show that worldwide, many systems are still vulnerable — either unpatched or unsupported for a long time.

Why do so many websites still run on old versions

• The website is running, and no one feels responsible.
• Old plugins, themes, or custom developments no longer work with newer PHP versions.
• The hosting provider continues to offer old versions, often for an additional fee (“extended support”).
• The agency from back then no longer exists.

How to plan the migration

1. Take inventory: PHP version, CMS version, plugins, themes, custom developments.
2. Check compatibility: Do the CMS and extensions support PHP 8.3 or newer? Look for alternatives for outdated extensions.
3. Create a test copy: Test the website in a staging environment with the new PHP version.
4. Fix errors,then switch over – with a fresh backup.
5. Then update regularly:Schedule updates instead of waiting for the next warning.

If the website is so old that a migration is more complex than a rebuild, it is worth considering a website relaunch. A modern system with clear update paths saves effort and risk in the long term.

Unsure whether your website, online shop or devices are affected? Get in touch with us. We check your systems, install updates and tell you honestly what needs to be done – even if it turns out that everything is fine. To get started, a brief conversation.

Frequently asked questions

Which PHP version should I use?

A version with active support, currently PHP 8.3, 8.4 or 8.5 in the latest minor release of each. PHP 8.2 will only receive security updates until the end of 2026.

Can a PHP update break my website?

Yes, if plugins, themes or custom code are not compatible. That is why you should test it on a staging copy first and keep a current backup ready.

My host offers “extended support” for old PHP versions. Is that enough?

That can be a temporary solution if the provider backports security fixes. Ask specifically whether PHP2Shell is covered, and still plan the migration.

As of: October 2026. Source: BSI security advisory on PHP2Shell.