PHP 8.3 gets security fixes only, until December 31, 2027, when it reaches end of life (433 days from now). Its PHP2Shell fix is 8.3.36; any 8.3 release before that has the flaw. Update to 8.3.36 now and plan a move to PHP 8.4 or 8.5.
- days of security fixes left
- 433
- PHP2Shell fix for this line
- 8.3.36
- where to move next
- 8.4 or 8.5
PHP 8.3 support dates
| PHP 8.3 | |
|---|---|
| Released | November 23, 2023 |
| Active support until | December 31, 2025 |
| Security fixes until | December 31, 2027 |
| Status today | Security fixes only |
| Latest release | 8.3.36 |
| PHP2Shell | Fixed in 8.3.36. Releases 8.3.0 to 8.3.35 have the flaw. |
Is PHP 8.3 affected by PHP2Shell?
Yes, until it's updated. PHP fixed the 2 PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) in 8.3.36 on October 21, 2026. Releases 8.3.0 to 8.3.35 have them. A site on PHP 8.3 needs 8.3.36 or later; your host or developer applies it, then restarts PHP.
PHP 8.3 on Ubuntu 24.04
Ubuntu 24.04 ships PHP 8.3 as the default package. Linux distributions add security fixes to their own PHP packages without changing the version number, so a server there can report an older-looking 8.3 version and still have fixes. Check the distribution's own security notice, or ask your host.
Moving off PHP 8.3
- Find out which PHP version your site runs now. How to check your PHP version covers WordPress, hosting panels and the command line.
- Check that your platform, theme and plugins support PHP 8.4 or 8.5. WordPress shows this in Tools, then Site Health.
- Try the new version on a staging copy first if your host offers one.
- Switch the live site in your hosting panel (cPanel and most hosts let you pick the version), then test forms and checkout.
Questions people ask
When does PHP 8.3 reach end of life?
On December 31, 2027. Until then PHP publishes security fixes only for it.
Is PHP 8.3 safe to use?
It still gets security fixes, as long as you run the latest 8.3 release. For PHP2Shell that means 8.3.36 or later. No version can be promised safe; staying on a current release is what keeps known flaws closed.
Does my host update PHP for me?
On shared and managed hosting, the host usually provides PHP and applies its security releases; you choose the version line in your panel. On a server you run yourself, your developer does it. Ask them to confirm.
Which PHP version should my website use?
The newest version your platform, theme and plugins support. Today that means PHP 8.4 or 8.5 for most sites.
Sources
- PHP: Supported versions
- PHP: Unsupported branches (end of life)
- PHP: security release announcement, October 21, 2026
Checked against these sources on October 22, 2026. PHP Scanner is a free tool from Catch Digital and is not affiliated with the PHP project.