PHP 7.4, 8.0 and 8.1 backports for PHP2Shell: what they mean for your WordPress site
Short answer
For the October 2026 flaws, the PHP project released fixes only for 8.2 to 8.5. For 7.4, 8.0 and 8.1, it published minimal source backports: patches “to help people building from source or without access to an LTS vendor”. They’re not releases you install from a hosting panel. For a hosted WordPress site, it means: ask your host whether they applied a backport (some Linux distributions and paid LTS vendors ship them), and plan the upgrade to a supported version either way, because the next flaw may get no backport at all.
What php.net says
From the security advisory of 21 October 2026 (php.net):
- “PHP 8.1 and older no longer receive updates from the PHP project. Some distributions and LTS vendors provide backported fixes, so contact your vendor for details, or upgrade to a supported version.”
- “Given the severity of these vulnerabilities, the PHP security team provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to help people building from source or without access to an LTS vendor.”
What a source backport is
A backport is a fix written for a newer version and adapted to an older one. A source backport is a code patch: someone has to apply it and build PHP from it. That’s routine for Linux distributions and companies that sell long-term support, and possible for anyone running their own server. On shared or managed hosting, it’s up to the host.
What it means for your site
| Your site | What to do |
|---|---|
| PHP 7.4, 8.0 or 8.1 on hosting | Ask the host whether they applied a backport or a vendor fix (what to ask), and plan the upgrade |
| PHP 7.4, 8.0 or 8.1 on your own server | Use your distribution’s or vendor’s fixed package, or build with the backport; plan the upgrade |
| PHP 8.2 or later | Not concerned by backports: update to the patched release (which one) |
Why upgrade anyway
These branches are past their end of life (php.net): 7.4 since 28 November 2022, 8.0 since 26 November 2023, 8.1 since 31 December 2025. The October backports were an exception, made “given the severity of these vulnerabilities” (php.net). The next flaw may not get one.
The way out: upgrade WordPress from PHP 7.4, 8.0 or 8.1 safely, or from 8.1 specifically, 8.1 to 8.3 step by step. Before switching, check your plugins and theme for the target version; CompatNav, free on wordpress.org, runs on PHP 7.4 and does it on your own server.
Key takeaways
- No official PHP release for 7.4, 8.0 or 8.1: these branches are past their end of life.
- The PHP team published minimal source backports, for people who build PHP themselves.
- Some distributions and LTS vendors ship backported fixes; your host may use one.
- A backport covers these two flaws, not future ones.
- The lasting fix is an upgrade to PHP 8.3 or later, checked first.
Frequently asked questions
How do I know if my host applied a backport?
Ask in writing. The PHP version number in Site Health may not change with a backport, so the host’s confirmation is what counts.
Is a backport as good as an update?
For these two flaws, it’s meant to close them. But your PHP branch still gets no fixes for anything found later, unless your vendor provides them.
Can I apply the backport myself?
Only if you build PHP from source on your own server. On hosted plans, PHP is managed by the host.
Check your own site before you upgrade
CompatNav is a free WordPress plugin. It reads the code of your plugins and themes on your own server and tells you, in plain words, what will break and what will only show notices on the PHP version you choose. It never changes your code. It can’t see problems that only appear while code runs with real data, so a quick check of your site after the upgrade still matters.
Sources
About the code examples: each output is the real output of the code shown, run with the official PHP builds, without a php.ini, with all errors reported and displayed. Only the file path was replaced by a neutral server path.