PHP 8.4 is in active support until December 31, 2026 and gets security fixes until December 31, 2028. Its PHP2Shell fix is 8.4.27, released October 21, 2026; any 8.4 release before that has the flaw. Update to 8.4.27 or later.
- security fixes until
- Dec 31, 2028
- PHP2Shell fix for this line
- 8.4.27
PHP 8.4 support dates
| PHP 8.4 | |
|---|---|
| Released | November 21, 2024 |
| Active support until | December 31, 2026 |
| Security fixes until | December 31, 2028 |
| Status today | Active support |
| Latest release | 8.4.27 |
| PHP2Shell | Fixed in 8.4.27. Releases 8.4.0 to 8.4.26 have the flaw. |
Is PHP 8.4 affected by PHP2Shell?
Yes, until it's updated. PHP fixed the 2 PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) in 8.4.27 on October 21, 2026. Releases 8.4.0 to 8.4.26 have them. A site on PHP 8.4 needs 8.4.27 or later; your host or developer applies it, then restarts PHP.
Keeping PHP 8.4 up to date
- Find out which PHP version your site runs now. How to check your PHP version covers WordPress, hosting panels and the command line.
- Ask your host or developer to apply PHP 8.4.27 or later.
- Clear caches and load your key pages, forms and checkout.
- Run PHP Scanner again to confirm what your site reports.
Questions people ask
When does PHP 8.4 reach end of life?
On December 31, 2028. Until then PHP publishes bug and security fixes for it.
Is PHP 8.4 safe to use?
It still gets security fixes, as long as you run the latest 8.4 release. For PHP2Shell that means 8.4.27 or later. No version can be promised safe; staying on a current release is what keeps known flaws closed.
Does my host update PHP for me?
On shared and managed hosting, the host usually provides PHP and applies its security releases; you choose the version line in your panel. On a server you run yourself, your developer does it. Ask them to confirm.
Which PHP version should my website use?
The newest version your platform, theme and plugins support. Today that means PHP 8.4 or 8.5 for most sites.
Sources
- PHP: Supported versions
- PHP: Unsupported branches (end of life)
- PHP: security release announcement, October 21, 2026
Checked against these sources on October 22, 2026. PHP Scanner is a free tool from Catch Digital and is not affiliated with the PHP project.