PHP2Shell, two critical PHP flaws (CVSS 9.2), went public on October 21, 2026, and an exploit attempt was recorded four days before the fix. PHP 8.1 lost security support on December 31, 2025, so the official fix skipped it. The PHP security team issued only an unofficial source backport. Moving to PHP 8.4 restores official patches within 7 days for most small and mid-sized apps. Read the news coverage.
PHP 8.1 to PHP 8.4 upgrade services return US apps to a release with official patches. PHP 8.1 security support ended on December 31, 2025, less than ten months before PHP2Shell appeared, so the official fix missed it by a narrow margin.
If your team adopted enums, readonly properties or fibers on 8.1, the code is in good shape. The work ahead is mostly about three releases of deprecations. PHP 8.2 deprecated undeclared properties, which is the item that touches the most files in older codebases, along with utf8_encode(), utf8_decode() and "${var}" interpolation. PHP 8.3 deprecated calling get_class() with no argument. PHP 8.4 deprecated implicitly nullable parameters, the E_STRICT constant and trigger_error() with E_USER_ERROR, and moved IMAP, OCI8 and Pspell out of the bundled extensions.
The framework needs the same attention. Laravel 10, a common partner for PHP 8.1, stopped receiving security fixes in early 2025, so framework and PHP move forward together and launch on a patched 8.4 release.
Why PHP 8.1 is no longer enough
The version still runs, but it gets no official fixes, and PHP2Shell turned that gap into a real exposure this October.
Back inside the support window
PHP 8.4 gets security releases until December 31, 2028 and ships the PHP2Shell fix from 8.4.27 onward.
Code ready for what comes next
Cleaning up 8.2 to 8.4 deprecations now means the next big PHP release will not land as a wall of errors.
Newer tools to write with
Readonly classes, DNF types, the Random extension, typed class constants, #[\Override], property hooks and asymmetric visibility all become available to your developers.
What a PHP 8.1 upgrade includes
- Ad-hoc properties declared, or #[AllowDynamicProperties] added where it is the right call
- utf8_encode() and utf8_decode() replaced with mbstring functions
- "${var}" interpolation rewritten
- get_class() calls given an explicit argument
- Implicitly nullable parameters made explicit for PHP 8.4
- E_STRICT and E_USER_ERROR usage cleaned up
- Laravel 10 or Symfony 6 moved to a supported release
- Production switched to a patched PHP 8.4 build and monitored
How the PHP 8.1 upgrade week runs
Day 1: Measure
The app boots on PHP 8.4 in a container, every deprecation and error gets logged, and that list sets the quote.
Days 2-4: Refactor
Ad-hoc properties and other deprecations get fixed, and the framework and Composer packages come up to date.
Days 5-6: Retest
Your test suite runs on 8.4, and we check the screens and jobs that tests do not cover. You review a staging build.
Day 7: Go live
PHP 8.4 goes to production in a quiet window, with the 8.1 build kept ready to restore.
PHP 8.1 and PHP 8.4 compared
Three years of releases, and one big difference in support.
| PHP 8.1 | PHP 8.4 | |
|---|---|---|
| Security support | Ended December 31, 2025 | Continues until December 31, 2028 |
| PHP2Shell | Backport only | Fixed in 8.4.27 and later |
| Ad-hoc properties | Allowed | Deprecated by default |
| Bundled extensions | IMAP, OCI8 and Pspell included | Moved to PECL |
| Default bcrypt cost | 10 | 12 |
| Newest language tools | Enums, readonly properties, fibers | Readonly classes, typed constants, property hooks |
Why teams choose us for PHP 8.1 upgrades
Ad-hoc properties get fixed without changing behavior, even in a model class that carries forty magic fields.
Behavior stays the same
Declared properties or proper classes replace the undeclared fields, and tests confirm each object still holds exactly the data it held before.
Changes delivered as reviewable pull requests.
Fixed quote built from a scan of your code.
Help for US companies still on PHP 8.1
This service lets US businesses and agencies move PHP 8.1 apps without pausing feature work. Techno Mantra is an AI and web development company that builds AI applications, websites, SEO programs and custom CRM systems for businesses in the US, Canada and Australia.
Work runs under your NDA, in your repository, for one fixed fee, with calls overlapping US Eastern hours and replies within one business day.
Official sources: PHP supported versions · PHP security releases · PHP 8.4 migration guide
Frequently asked questions
Straight answers about our PHP 8.1 to PHP 8.4 Upgrade service.
Most small and mid-sized apps make the move in 7 days. Large systems follow a phased plan instead, with the first part running live on PHP 8.4 inside that week and the rest after it.
Only unofficially. The PHP security team published a source backport for 8.1, while official releases with the fix exist only for 8.2 through 8.5.
Usually not, because such code needs fewer fixes. The main work is ad-hoc properties from 8.2, a handful of 8.4 deprecations and the framework upgrade.
PHP 8.4 raised the default cost for password_hash() from 10 to 12. Old hashes still verify, so nobody has to reset a password. New hashes are a little stronger and slightly slower to create.
Only if your app reads mailboxes with imap_* functions. In that case we either install the PECL extension or switch you to a maintained library before launch.
Yes. Companies across the USA get one project manager, an optional NDA and a price fixed before work starts.
Is your PHP app still on an old version?
Send the URL or repository, under NDA if needed. The audit checks for the PHP2Shell flaw and outdated code and shows what a 7-day migration looks like.
Request a migration audit