Still on PHP 7.4, 8.0 or 8.1? How to upgrade WordPress safely
Short answer
The October 2026 PHP security release only covered PHP 8.2 to 8.5: php.net says “PHP 8.1 and older no longer receive updates from the PHP project.” A site on 7.4, 8.0 or 8.1 therefore stays exposed unless its host applies a vendor backport. The safe way out is an upgrade to PHP 8.3 or 8.4, in one switch, prepared in four steps: check every plugin and your theme for the target version, update or replace what will break, test on a staging copy if you can, then switch and watch the log. Most of the work is in plugins that haven’t been updated in years.
Why 7.4, 8.0 and 8.1 are now a problem
php.net, in the security advisory of 21 October 2026: “PHP 8.1 and older no longer receive updates from the PHP project. Some distributions and LTS vendors provide backported fixes, so contact your vendor for details, or upgrade to a supported version.” (php.net)
The PHP team made one exception: it “provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to help people building from source or without access to an LTS vendor.” What that means for a hosted site: the 7.4, 8.0 and 8.1 backports. In short, ask your host, and plan the upgrade either way.
Which version to move to
| Version | Security fixes until |
|---|---|
| 8.2 | 31 December 2026 |
| 8.3 | 31 December 2027 |
| 8.4 | 31 December 2028 |
| 8.5 | 31 December 2029 |
Source: php.net. wordpress.org recommends 8.3 or greater. From an old version, 8.3 or 8.4 is the sensible target: newer means longer support, but more changes to check. Which version for 2026 compares them.
Upgrade safely, in four steps
- Check every plugin and your theme for the version you chose. From PHP 7.4 the check has to cover 8.0 to that version.
- Update, replace or fix each one that will break (what to do).
- Test on a staging copy with the new version, if your host offers one (how).
- Switch at a quiet time, then watch the site and its error log for a week. Keep the way back ready (how to downgrade).
What usually breaks
From 7.4 the big step is PHP 8.0, which removed or tightened things old plugins still rely on, such as the old argument order of implode(). The page stops:
wp-content/plugins/old-tags/old-tags.php
<?php
$tags = ['news', 'php', 'wordpress'];
echo implode($tags, ', '), "\n";
Deprecated: implode(): Passing glue string after array is deprecated. Swap the parameters in /var/www/html/wp-content/plugins/old-tags/old-tags.php on line 3
news, php, wordpressFatal error: Uncaught TypeError: implode(): Argument #2 ($array) must be of type ?array, string given in /var/www/html/wp-content/plugins/old-tags/old-tags.php:3
Stack trace:
#0 /var/www/html/wp-content/plugins/old-tags/old-tags.php(3): implode(Array, ', ')
#1 {main}
thrown in /var/www/html/wp-content/plugins/old-tags/old-tags.php on line 3A check that reads code finds these while your site still runs the old version:
The PHP 8.0 and 8.1 changes in full: moving from PHP 7.4 to PHP 8. From 8.1 specifically: PHP 8.1 to 8.3, step by step.
The check
CompatNav, a free plugin on wordpress.org, runs on PHP 7.4 and checks every plugin and theme for the version you choose, from 8.0 to 8.5. It reports only what changes between your version and the target, labelled “Will break” or “Deprecation notice”, on your own server. Getting started shows the first scan.
Key takeaways
- PHP 7.4, 8.0 and 8.1 got no official fix for CVE-2026-109618 and CVE-2026-109619.
- The PHP team published minimal source backports for them, mainly useful to people who build PHP themselves.
- Aim for PHP 8.3 or 8.4 in one move; the check must cover every version in between.
- From PHP 7.4, the changes of PHP 8.0 are the ones that stop pages; later versions mostly add notices.
- Check before switching, then keep the error log for a week after.
Frequently asked questions
Can I go straight from PHP 7.4 to 8.4?
Yes, as long as you check for everything that changed in between. A check from 7.4 to 8.4 covers 8.0, 8.1, 8.2, 8.3 and 8.4 together; CompatNav runs 45 checks for that move.
My host applied a backport. Am I safe?
Against these two flaws, if the backport is complete; ask your host to confirm. Your PHP version still gets no fixes for whatever is found next, so the upgrade remains the plan.
Why not just PHP 8.2?
PHP 8.2 gets security fixes only until 31 December 2026, two months from now. Moving to 8.3 (until 31 December 2027) or 8.4 (until 31 December 2028) avoids doing this again in January.
Check your own site before you upgrade
CompatNav is a free WordPress plugin. It reads the code of your plugins and themes on your own server and tells you, in plain words, what will break and what will only show notices on the PHP version you choose. It never changes your code. It can’t see problems that only appear while code runs with real data, so a quick check of your site after the upgrade still matters.
Sources
About the code examples: each output is the real output of the code shown, run with the official PHP builds, without a php.ini, with all errors reported and displayed. Only the file path was replaced by a neutral server path.