Still on PHP 7.4, 8.0 or 8.1? Your Options After PHP2Shell

By Umair Ali Sadaqat · Updated · Editorial policy

There is no official PHP release fixing Black October for PHP 8.1 and older. What the PHP team did provide, where patched builds can come from, and how to decide between backports and upgrading.

The PHP project only publishes releases for supported branches. On 21 October 2026 that meant fixed versions for 8.2, 8.3, 8.4 and 8.5. If your site runs on PHP 8.1, 8.0 or 7.x, there is no official download that fixes the Black October flaws. You still have options, and they differ a lot in effort and in how long they protect you.

What the PHP team did provide

Because of the severity, the security team published minimal source backports for PHP 7.4, 8.0 and 8.1 as branches in the php-src repository, linked from the advisory. These are source code, not packages. They exist to help people who build PHP from source or have no long-term support vendor. They contain these fixes only, not the other fixes those branches have missed since their end of life.

Option 1: your distribution or LTS vendor

The advisory says Linux distributions and LTS vendors received the patches in advance. If your PHP 8.1 or 7.4 came from an operating system that still supports it, or from a commercial long-term support vendor, a patched package may already exist:

  • Run your normal system update and read your distribution's security notice for the PHP package.
  • On CloudLinux servers (common with shared hosts) the alternative PHP builds are maintained by the vendor; ask your host to confirm their status.
  • Do not assume. A version string such as 8.1.2 can be patched or not depending on the package suffix; check the vendor's notice. Ways to read the version are in the version guide.

Option 2: build from the backport branches

If you run your own server, compile PHP yourself, and have no vendor, you can build from the PHP team's backport branch for your version. This takes real care: match your existing configure options and extensions, test on a non-production machine, and keep the old build ready to switch back. It protects you against these two flaws only.

Option 3: upgrade to a supported branch

The durable answer is moving to PHP 8.3 or 8.4, which have the longest support ahead of them. Keep in mind that PHP 8.2 receives security fixes only until 31 December 2026, so moving to 8.2 now buys about two months.

What usually breaks when moving from 7.4 or 8.0:

  • Old plugins, modules and themes using functions or behaviours that PHP 8 removed or made stricter.
  • Code passing null to functions that expect strings, which raises deprecation notices in 8.1 and later.
  • Dynamic properties on classes, deprecated in 8.2.

A practical path: copy the site to staging, switch the copy to the new PHP, turn on error logging, click through every important page and form, and fix or replace what fails. Static analysis tools such as PHPCompatibility for PHP_CodeSniffer, or Rector, can find many problems before you run anything.

Option 4: stopgap plus a short plan

If none of the above can happen this week, apply the temporary measures in the stopgap guide at server level and set a date for one of the real options. The stopgap reduces exposure; it does not end it.

How to decide

  • A vendor already ships a patched package: take it now, then still plan the upgrade. Old branches will have more problems than this one.
  • You compile PHP and have the skills: backport now, upgrade next.
  • Your site cannot run on PHP 8.2 or later and nobody can fix the code: that is a sign the site itself has reached end of life. Weigh a rebuild; our honest take is in should you move off PHP.

Move your site to WeInc

If upgrading an old PHP site means rewriting it anyway, rebuilding on a hosted platform may be the shorter road. Move your site to WeInc: first month free with code BLACKOCTOBER, until November 21, 2026. New customers only. Claim the offer

More in Blog

Related guides and tools

Start building

How we research, test and update this page: our editorial policy. We.Inc is our own product.

Product

Who It's For

Features

Resources

Company

View Sitemap