PHP2Shell, made public on 21 October 2026, is the biggest PHP security problem in years and can let an attacker run code on a server without logging in. It reaches PHP 7.3, yet the fixed releases start at PHP 8.2. For a shop taking orders on PHP 7.3, that is a real risk. Don't worry: we'll upgrade the site to a patched PHP 8.4 in 7 days. How a PHP update fixes it.
Plenty of online stores, booking sites and client portals still run on PHP 7.3, and our PHP 7.3 to PHP 8.4 upgrade services in USA and UK exist to move them safely. PHP 7.3 had its final security release on 6 December 2021. PHP2Shell is the first big reason since then that makes staying on it truly dangerous.
Sites on 7.3 are often stores built on WooCommerce, Magento 2.3 or custom carts, where a broken page means lost orders. The breaking changes hit these sites in specific places. PHP 8.0 turned GD image handles from resources into GdImage objects, so old is_resource() checks in thumbnail code fail. It removed money_format() and get_magic_quotes_gpc(), and the @ operator no longer hides fatal errors. PHP 8.1 made mysqli throw exceptions by default and deprecated FILTER_SANITIZE_STRING and strftime(). PHP 8.2 deprecated utf8_encode() and utf8_decode().
We fix those spots, update plugins, extensions and themes, then test the whole buying journey before the server moves to a patched PHP 8.4 release.
Why a PHP 7.3 site is worth upgrading now
Payment providers, card rules and search engines all lean toward sites on supported software. PHP 8.4 puts you back in that group.
Card data handled on patched software
Card security standards expect supported, patched systems. PHP 8.4.27 fixes PHP2Shell and 8.4 stays supported until 31 December 2028.
Faster product and category pages
The PHP 8 engine runs most store code faster than 7.3, and quicker pages help both conversion and search rankings.
Current plugins and extensions
Recent WooCommerce, Magento and payment gateway releases expect PHP 8. Upgrading lets you install the versions that carry their own security fixes.
What we cover in a PHP 7.3 upgrade
- Compatibility scan of custom code, plugins, extensions and themes
- GD image code updated for GdImage objects
- money_format(), magic quotes checks and other removed calls replaced
- mysqli error handling adjusted for exceptions in PHP 8.1
- FILTER_SANITIZE_STRING and strftime() swapped for current options
- utf8_encode() and utf8_decode() moved to mb_convert_encoding()
- Checkout, coupons, tax and shipping retested end to end
- Switch to a patched PHP 8.4 release at a low-sales hour
A 7-day PHP 7.3 upgrade, laid out
Day 1: Inventory
We list every plugin, extension, cron job and custom file, and check each one against PHP 8.4.
Days 2-4: Update and patch
Plugins and extensions are updated or replaced, and custom code is fixed on a staging store running PHP 8.4.
Days 5-6: Test orders
We place test orders with each payment method, run refunds, check emails and invoices, and let you try it too.
Day 7: Move live
The live store switches to PHP 8.4 during your quietest sales window, with a full backup ready for rollback.
How PHP 7.3 and PHP 8.4 differ
The rows a store owner or product manager will actually care about.
| PHP 7.3 | PHP 8.4 | |
|---|---|---|
| Security patches | None since 6 December 2021 | Provided until 31 December 2028 |
| PHP2Shell | Cannot be patched | Patched from 8.4.27 |
| Image handling | GD images are resources | GD images are GdImage objects |
| Database errors | mysqli returns false quietly | mysqli throws exceptions by default |
| Plugin support | Shrinking, many need PHP 8 now | Supported by current releases |
| Language features | Flexible heredoc, trailing commas | Named arguments, enums, property hooks |
Why store owners pick us for PHP upgrades
We treat the checkout as the most important page on your site, because it is.
Real test orders before launch
We run test purchases through each payment gateway on the PHP 8.4 copy, so the first real order after launch is not the first test.
Launch timed for your lowest sales hour.
Two weeks of log watching after go-live.
PHP 7.3 upgrades for American and British businesses
We set this service up for store owners and service companies in the US and the UK whose sites still sit on PHP 7.3 hosting. The team works from India on hours that overlap with the US Eastern morning and most of the UK day, so you hear back the same day.
Expect a signed NDA, a fixed price agreed before work starts and an offshore rate that leaves room in the budget for the marketing the store actually needs.
Official sources: PHP supported versions · PHP security releases · PHP 8.4 migration guide
Frequently asked questions
Straight answers about our PHP 7.3 to PHP 8.4 Upgrade service.
Most small and medium sites and stores are upgraded in 7 days. Very large stores with many custom modules get a phased plan, and the first part is live on PHP 8.4 within the same 7 days.
Yes. Both flaws reach every version back to PHP 5. The PHP project only shipped fixes for 8.2 and newer, so PHP 7.3 has no patch.
Most maintained plugins have PHP 8 versions, so we update them. For abandoned ones we find a replacement or patch the code ourselves, and you see the list before anything changes.
You can, but on a 7.3 site that usually causes broken pages or a white screen. The code has to be fixed first, which is exactly what we do on a copy before the host setting changes.
They should not. We work on a staging copy, switch at a quiet hour and keep a rollback ready. Most customers just see faster pages.
Yes. We work with stores and companies in the United States and United Kingdom, on hours that overlap with yours, with an NDA and a fixed price.
Is your PHP app still on an old version?
Send us the URL or the repository. We check it for the PHP2Shell flaw and old code for free, and tell you what a 7-day migration looks like.
Get a free migration audit