PHP2Shell broke on 21 October 2026: two critical flaws in PHP, rated 9.2 out of 10, that can let an outsider run code on your server. PHP 8.1 lost security support at the end of 2025, so it was left out of the fix, which covers PHP 8.2 and newer only. Don't worry: we'll get your PHP 8.1 app onto a patched PHP 8.4 in 7 days. Read the news coverage.
PHP 8.1 felt current until very recently, which is exactly why our PHP 8.1 to PHP 8.4 upgrade services in USA and UK are getting calls this month. Its security support ended on 31 December 2025, less than ten months before PHP2Shell appeared, so it missed the fix by a narrow margin.
If your team adopted enums, readonly properties or fibers on 8.1, the code is in good shape. The work ahead is mostly about three releases of deprecations. PHP 8.2 deprecated dynamic properties, which is the item that touches the most files in older codebases, along with utf8_encode(), utf8_decode() and "${var}" interpolation. PHP 8.3 deprecated calling get_class() with no argument. PHP 8.4 deprecated implicitly nullable parameters, the E_STRICT constant and trigger_error() with E_USER_ERROR, and moved IMAP, OCI8 and Pspell out of the bundled extensions.
There is also the framework. Laravel 10, a common partner for PHP 8.1, stopped receiving security fixes in early 2025. We bring the framework and PHP forward together and launch on a patched 8.4 release.
Why PHP 8.1 is no longer enough
The version still runs fine. It just cannot be fixed any more, and that changed from a theory to a fact this October.
Back inside the support window
PHP 8.4 gets security releases until 31 December 2028 and ships the PHP2Shell fix from 8.4.27 onward.
Code ready for what comes next
Cleaning up 8.2 to 8.4 deprecations now means the next big PHP release will not land as a wall of errors.
Newer tools to write with
Readonly classes, DNF types, the Random extension, typed class constants, #[\Override], property hooks and asymmetric visibility all become available to your developers.
What a PHP 8.1 upgrade includes
- Dynamic properties declared, or #[AllowDynamicProperties] added where it is the right call
- utf8_encode() and utf8_decode() replaced with mbstring functions
- "${var}" interpolation rewritten
- get_class() calls given an explicit argument
- Implicitly nullable parameters made explicit for PHP 8.4
- E_STRICT and E_USER_ERROR usage cleaned up
- Laravel 10 or Symfony 6 moved to a supported release
- Production switched to a patched PHP 8.4 build and monitored
How the PHP 8.1 upgrade week runs
Day 1: Measure
We boot the app on PHP 8.4 in a container, log every deprecation and error, and quote a fixed price from that list.
Days 2-4: Refactor
Dynamic properties and other deprecations are fixed, and the framework and Composer packages are brought up to date.
Days 5-6: Retest
Your test suite runs on 8.4, and we check the screens and jobs that tests do not cover. You review a staging build.
Day 7: Go live
PHP 8.4 goes to production in a quiet window, with the 8.1 build kept ready to restore.
PHP 8.1 and PHP 8.4 compared
Three years of releases, and one big difference in support.
| PHP 8.1 | PHP 8.4 | |
|---|---|---|
| Security support | Ended 31 December 2025 | Continues until 31 December 2028 |
| PHP2Shell | Not patched | Fixed in 8.4.27 and later |
| Dynamic properties | Allowed | Deprecated by default |
| Bundled extensions | IMAP, OCI8 and Pspell included | Moved to PECL |
| Default bcrypt cost | 10 | 12 |
| Newest language tools | Enums, readonly properties, fibers | Readonly classes, typed constants, property hooks |
Why teams choose us for PHP 8.1 upgrades
Dynamic properties look simple until you hit a model class with forty magic fields. We know how to fix them without changing behaviour.
Behaviour stays the same
We add declared properties or proper classes in place of ad hoc fields, and test that each object still holds exactly the data it held before.
Changes delivered as reviewable pull requests.
Fixed quote from a real scan, not a guess.
Help for USA and UK companies still on PHP 8.1
This service is meant for US and UK businesses and agencies that run PHP 8.1 apps and need them moved without stopping feature work. We work from India on shifted hours that overlap with East Coast mornings and the UK office day, and we reply the same day.
We work under your NDA, in your repository, for one fixed fee. The offshore rate keeps it far cheaper than pulling your own developers off the roadmap for a week.
Official sources: PHP supported versions · PHP security releases · PHP 8.4 migration guide
Frequently asked questions
Straight answers about our PHP 8.1 to PHP 8.4 Upgrade service.
Most small and medium apps are moved in 7 days. For very large systems we agree a phased plan, and the first part runs live on PHP 8.4 within the same 7 days while the rest follows.
No. The official fixes were released for PHP 8.2, 8.3, 8.4 and 8.5. PHP 8.1 reached end of life on 31 December 2025 and did not get one.
Usually not. Modern PHP 8.1 code tends to need fewer fixes. The main work is dynamic properties from 8.2, a handful of 8.4 deprecations and the framework upgrade.
PHP 8.4 raised the default cost for password_hash() from 10 to 12. Old hashes still verify, so nobody has to reset a password. New hashes are just a little stronger and slightly slower to create.
Only if your app reads mailboxes with imap_* functions. In that case we either install the PECL extension or switch you to a maintained library before launch.
Yes. We upgrade PHP apps for companies across the USA and UK, with an NDA, a fixed price and contact during your office hours.
Is your PHP app still on an old version?
Send us the URL or the repository. We check it for the PHP2Shell flaw and old code for free, and tell you what a 7-day migration looks like.
Get a free migration audit