PHP2Shell, the most severe PHP flaw in years, was disclosed on 21 October 2026, and Amazon's threat team logged the first attack attempt four days earlier. Being on PHP 8 does not help here: the fix starts at PHP 8.2, and PHP 8.0 gets nothing. Don't worry: we move PHP 8.0 apps to a patched PHP 8.4 in 7 days. What PHP2Shell means for your site.
A lot of teams assume that anything starting with an 8 is safe. Our PHP 8.0 to PHP 8.4 upgrade services in USA and UK are for the many who found out otherwise this week. PHP 8.0 ran out of security support on 26 November 2023, and it is not among the versions that received the PHP2Shell fix.
The good news: you already made the hardest jump. Your code survived the PHP 8.0 changes to string comparison, TypeErrors and removed functions. What is left is a list of smaller items. PHP 8.1 deprecated passing null to non-nullable parameters of built-in functions, asked for return types on methods that extend internal classes, and switched mysqli to exceptions by default. PHP 8.2 deprecated dynamic properties and "${var}" string interpolation. PHP 8.4 deprecated implicitly nullable parameter types and moved the IMAP extension out of the core.
None of these is huge on its own. Together they touch many files, and the framework your app sits on, often Laravel 8 or 9 or Symfony 5, also needs to move up. We handle both in one planned week.
What PHP 8.0 users get from PHP 8.4
Four releases of features and fixes, without the pain of a PHP 7 to 8 migration.
A patch that exists
PHP 8.4.27 fixes both PHP2Shell CVEs. The 8.4 branch keeps getting security releases until 31 December 2028, five years past 8.0's end date.
Language features you can use today
Enums and readonly properties from 8.1, readonly classes from 8.2, typed class constants from 8.3 and property hooks from 8.4 all become available.
Up-to-date frameworks
Laravel 11 and 12 and Symfony 7 need PHP 8.2 or newer. Moving to 8.4 lets your framework catch up and get its own security fixes again.
Tasks in a PHP 8.0 to 8.4 upgrade
- Null arguments to internal functions tracked down and handled
- #[\ReturnTypeWillChange] or real return types added where needed
- mysqli code reviewed for exception-based error handling
- Dynamic properties declared or moved to proper classes
- "${var}" interpolation rewritten as {$var}
- Implicitly nullable parameters changed to explicit ?Type
- IMAP code switched to a maintained library if your app reads mailboxes
- Framework upgraded and server moved to a patched PHP 8.4 build
Seven-day plan from PHP 8.0 to 8.4
Day 1: Collect deprecations
We run the test suite and PHPStan on PHP 8.4 with all deprecation notices on, and turn the output into a priced task list.
Days 2-4: Clear the list
Rector handles the repeatable fixes, a developer handles the rest, and the framework is upgraded in supported steps.
Days 5-6: Regression test
Automated tests plus hands-on checks of your main user flows, compared against the 8.0 build.
Day 7: Deploy
We roll PHP 8.4 onto production at a quiet hour and keep the 8.0 image ready for an instant rollback.
PHP 8.0 versus PHP 8.4
Both are PHP 8, but only one of them is still looked after.
| PHP 8.0 | PHP 8.4 | |
|---|---|---|
| Security support | Ended 26 November 2023 | Lasts until 31 December 2028 |
| PHP2Shell | No official fix | Fixed from 8.4.27 |
| Enums and readonly | Not available | Native enums, readonly properties and classes |
| Dynamic properties | Allowed silently | Deprecated unless the class opts in |
| Framework support | Laravel 9, Symfony 5.4 | Laravel 12, Symfony 7 |
| Newest additions | Match, named arguments, JIT | Property hooks, asymmetric visibility, array_find() |
Why our upgrades from PHP 8.0 go smoothly
We use automated refactoring where it is safe and human review where it is not, and we know which is which.
Automation with a human check
Rector rewrites the repetitive patterns in minutes, then a senior developer reviews every diff so nothing odd slips into your code.
No downtime switch with rollback ready.
Clear notes on every change for your own team.
PHP 8.0 upgrades for USA and UK development teams
This upgrade is shaped for product owners and in-house developers in the United States and the United Kingdom who have a PHP 8.0 app and no spare sprint to deal with it. Our India-based team works hours that cross into the US Eastern day and the UK office day, with replies the same day.
We sign your NDA, quote one fixed price and work in your Git repository, at an offshore cost well under what a local contractor would charge.
Official sources: PHP supported versions · PHP security releases · PHP 8.4 migration guide
Frequently asked questions
Straight answers about our PHP 8.0 to PHP 8.4 Upgrade service.
Most small and medium apps are done in 7 days, framework upgrade included. Very large systems get a phased plan where the first service or module is live on PHP 8.4 within the same 7 days.
Yes, if it is PHP 8.0 or 8.1. The flaws reach every version back to PHP 5, and fixes were released only for 8.2, 8.3, 8.4 and 8.5.
On PHP 8.4, deprecations only log notices and the code still runs. They do mark what will break in a future major version, so we clear them now while the list is short and easy.
Usually yes. Laravel 9 and Symfony 5.4 are past their support dates, and newer framework versions require PHP 8.2 or above. We upgrade the framework in steps as part of the same fixed price.
You could, and both can be patched. But 8.2 loses security support on 31 December 2026 and 8.3 a year later, so 8.4 gives you the longest runway for nearly the same effort.
Yes. We upgrade PHP apps for companies across the United States and the United Kingdom, with an NDA, a fixed price and daily updates in your working hours.
Is your PHP app still on an old version?
Send us the URL or the repository. We check it for the PHP2Shell flaw and old code for free, and tell you what a 7-day migration looks like.
Get a free migration audit