How to Upgrade PHP Safely: A Five-Stage Application Upgrade Runbook
                     S O F T P R O D I G Y   ·   A P P L I C A T I O N  M O D E R N I Z A T I O N
P H P  R I S K  M E T E R ILLUSTRATIVE
Is Your PHP Version 
Still Safe?
A health check for outdated PHP: the risks, the support 
dates and a safe way to upgrade.
Supported Plan ahead Act now End of life
PHP 8.1 and older: end of life. No official security fixes.
Read the full blog  → softprodigy.com Check your version, then plan the move before support ends.
P H P  H E A LT H  C H E C K    |    S o ft P r o d i g y CRITICAL
Alert: PHP2Shell targets unpatched PHP
Disclosed Oct 21, 2026: two critical remote code execution flaws let unauthenticated attackers run code on vulnerable PHP 
servers.
U P D AT E  T O  AT  L E A S T
CVE-2026-109618 UNAUTHENTICATED  ·   RCE
PHP 8.2
Out-of-memory handling goes wrong, opening a path to code execution. 8.2.35
PHP 8.3 8.3.36
CVE-2026-109619 UNAUTHENTICATED  ·   RCE PHP 8.4 8.4.27
Stale global state keeps pointing at freed memory, with the same 
unauthenticated risk.
PHP 8.5 8.5.12
What to do: check the version actually serving your site, install the matching update and treat patching as ongoing work. WordPress, Drupal and Joomla all run 
on PHP, and exploit code is circulating.
Read the full blog  →   ·   softprodigy.com   ·   Call (516) 673-7070 2
P H P  H E A LT H  C H E C K    |    S o ft P r o d i g y AS OF NOV 2026
PHP version health: how much runway is left?
S E C U R I T Y  S U P P O R T  R U N W A Y
PHP 8.1 and older END OF LIFE No official security fixes
PHP 8.2 ACT NOW Dec 31, 2026  ·  about 2 months
PHP 8.3 PLAN Dec 31, 2027  ·  about 14 months
PHP 8.4 HEALTHY Dec 31, 2028  ·  about 26 months
PHP 8.5 HEALTHY Dec 31, 2029  ·  about 38 months
PHP 8.2: assess upgrade options now, not after the deadline. Newest isn't automatically best: your stack decides the target.
Read the full blog  →   ·   softprodigy.com   ·   Call (516) 673-7070 3
P H P  H E A LT H  C H E C K    |    S o ft P r o d i g y 3 RISKS
Risk register: what waiting really costs
R I S K W H AT  I T  L O O K S  L I K E S E V E R I T Y F I R S T  S T E P
Security vulnerabilities End-of-life PHP gets no official fix for new flaws: malicious Patch or move to a supported 
redirects, injected scripts, leaked data, downtime. CRITICAL version
Compatibility problems Plugins, libraries, payment SDKs and APIs drop old PHP. Audit dependencies before picking 
Old custom code can break on newer PHP. HIGH a target
Rising maintenance cost Hours lost to old libraries, emergency fixes and features Budget the upgrade, not the 
you can't ship. Savings are delayed, not avoided. MEDIUM outage
Already hacked? Upgrading PHP won't undo the damage. Add a malware scan, code cleanup, password and key resets and a wider security review.
Read the full blog  →   ·   softprodigy.com   ·   Call (516) 673-7070 4
P H P  H E A LT H  C H E C K    |    S o ft P r o d i g y 2-MINUTE CHECK
Step zero: find the PHP version you really run
WordPress Custom application
Tools › Site Health › Info › Server $ php -v
PHP 8.x.x (cli)
Look for “PHP version” in the server info. Hosting panels often show it per 
domain too. CLI is not the web. The command-line version can differ from the one 
Don't switch yet: confirm theme, plugins and custom code support the serving requests (PHP-FPM, Apache module).
target release.
Check every environment, not just production
Deployment 
PHP runtime Frameworks and dependencies Extensions Configuration
process
Security tip: never leave a public phpinfo() page on production; it exposes configuration details attackers can use.
Read the full blog  →   ·   softprodigy.com   ·   Call (516) 673-7070 5
P H P  H E A LT H  C H E C K    |    S o ft P r o d i g y RUNBOOK
Upgrade runbook: five stages, five exit checks
Stage Do this Done when
1  Audit List PHP version, framework, libraries, database drivers, server config and Every dependency has a supported-version integrations (every WordPress theme and plugin). answer
2  Pick a target Choose a supported release that your framework, key libraries and host all support. Target version agreed and documented
3  Test on staging Mirror production, apply the upgrade and test logins, checkout, payments, emails and reports. Critical journeys pass on staging
4  Back up, plan rollback Verified backups of database, files and config, plus written rollback steps and an A restore has been testedowner.
5  Deploy and watch Release in a quiet window; monitor logs, performance and key transactions Metrics stay stable after the watch periodbeyond the first hour.
Never switch PHP on a live server and hope. Stage it, test it, back it up. Application development  →    Software testing  →    DevOps  →
Read the full blog  →   ·   softprodigy.com   ·   Call (516) 673-7070 6
P H P  H E A LT H  C H E C K    |    S o ft P r o d i g y DECISION GUIDE
Upgrade, refactor or modernize? A quick decision path
YES
Signs of trouble
Is the app maintainable, just on an unsupported PHP version? PHP version upgrade
• Small changes take big 
effort
YES • Unmaintained 
dependencies
Is the code hard to maintain, with recurring defects? Code refactoring • Constant integration 
workarounds
• Performance 
YES bottlenecks
Is the architecture limiting security or integrations? Application modernization
YES
React is not a PHP 
Do hosting or platform limits hold you back? Platform migration replacement. It's a frontend 
library; keep PHP as the 
backend and add React via 
APIs.
Legacy application modernization  →
Still no? Full redevelopment for apps that can't meet future needs.
Read the full blog  →   ·   softprodigy.com   ·   Call (516) 673-7070 7
P H P  H E A LT H  C H E C K    |    S o ft P r o d i g y FAQ
Outdated PHP version: quick answers
What happens if I keep using an outdated PHP version?
Talk to SoftProdigy
You may face security flaws that never get patched and growing compatibility problems with 
plugins, libraries and integrations. Check your version's support status and plan an upgrade.
U S  O F F I C E
78 Oliphant Ave, Dobbs Ferry, NY 10522
Can I upgrade PHP without rebuilding my website?
Phone  (516) 673-7070
Often, yes. Effort depends on your code, framework support and dependencies; an assessment and 
Email  [email protected]
staging tests show whether a version upgrade is enough.
Web  softprodigy.com
Will upgrading PHP fix a hacked WordPress site? F O L L O W  U S
No. It closes old-version vulnerabilities but won't remove malware, compromised accounts or  Facebook  |  X  |  LinkedIn
vulnerable plugins. A hacked site needs its own cleanup. YouTube  |  Instagram
Should I migrate my PHP application to React? Read the full blog  →
React builds interfaces while PHP handles server-side logic. You can often add a React frontend and 
keep PHP as the backend. Hiring a PHP developer? 6 factors  →
Read the full blog  →   ·   softprodigy.com   ·   Call (516) 673-7070 8