Most website owners never think about which PHP version their site runs on — until it stops getting security fixes. PHP is the engine behind WordPress and most small-business sites, and when a PHP branch reaches end of life, it gets no more patches at all, even for critical flaws. An unpatched engine is an open door, no matter how strong your passwords are.
Here is where things stand right now. PHP 8.1 and every older branch are already end of life — 8.1 since 31 December 2025, 8.0 since 26 November 2023, and 7.4 since 28 November 2022. Only PHP 8.2, 8.3, 8.4 and 8.5 still receive security fixes, and PHP 8.2 stops getting them on 31 December 2026 — weeks away. That deadline matters twice over: in October 2026, PHP released emergency fixes for two critical remote-code-execution flaws (the 'PHP2Shell' flaws), and the fixed releases exist only for the supported branches — 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If you are on 8.1 or older, there is no official fixed release waiting for you.
Check three things this week. First, find your version — in WordPress, look under Tools → Site Health → Info → Server, or ask your host; it takes a minute. Second, if you are on 8.1 or older, plan an upgrade now, not 'when something breaks' — and if you are on 8.2, plan the move to 8.4 or 8.5 before its 31 December 2026 cutoff. Third, before upgrading, take a full backup, check that your theme and plugins support the newer version, and test on a staging copy if your host offers one — a rushed upgrade that breaks the site helps no one.
A supported PHP version does not make a site secure on its own, but an unsupported one guarantees known flaws will never be fixed. Run a free check of your site's exposure at https://vulnerabilitytools.com/ and make the PHP version part of your regular security routine, alongside updates, backups and scans.
