PHP2Shell, the most serious PHP flaw in years, was published on 21 October 2026. PHP 8.2 is one of the lucky versions: the fix is in PHP 8.2.35, and you should install it right away. The catch is that PHP 8.2 stops getting any security fixes on 31 December 2026, so the next flaw will find it unprotected. Don't worry: we patch you now and upgrade the app to PHP 8.4 in 7 days. See how to update PHP safely.
Sites on PHP 8.2 have a choice most other PHP sites do not. You can patch PHP2Shell today by moving to PHP 8.2.35. Our PHP 8.2 to PHP 8.4 upgrade services in USA and UK start there, with the patch applied as an emergency task, and then take your app to PHP 8.4 before 8.2 runs out of support.
That deadline is close. PHP 8.2 security support ends on 31 December 2026, roughly ten weeks from now. After that date there will be no 8.2.36 for the next flaw, and the scramble you are seeing this week will repeat. PHP 8.4, in contrast, keeps receiving security releases until 31 December 2028.
The code changes from 8.2 to 8.4 are modest. PHP 8.3 deprecated get_class() and get_parent_class() without an argument and deprecated assert_options(). PHP 8.4 deprecated implicitly nullable parameter types, the E_STRICT constant and trigger_error() with E_USER_ERROR, deprecated mysqli_ping(), and moved IMAP, OCI8 and Pspell out of the core. Most apps clear this list well inside a week.
Patch now, but plan for PHP 8.4
8.2.35 fixes today's problem. PHP 8.4 fixes the calendar problem that arrives on New Year's Eve.
Two extra years of fixes
Moving from 8.2 to 8.4 shifts your security end date from 31 December 2026 to 31 December 2028, and 8.4.27 already includes the PHP2Shell fix.
One upgrade instead of two
Going to 8.3 would only buy one more year. Jumping straight to 8.4 covers both releases' changes in the same week of work.
New features for your developers
Typed class constants, json_validate() and #[\Override] from 8.3, plus property hooks, asymmetric visibility and array_find() from 8.4.
What our PHP 8.2 service includes
- Same-day update to PHP 8.2.35 to close PHP2Shell
- Check that the patched build is the one your web server actually loads
- Scan for PHP 8.3 and PHP 8.4 deprecations
- Implicitly nullable parameters rewritten as explicit ?Type
- get_class(), assert_options() and E_STRICT usage cleaned up
- IMAP or OCI8 code handled if your app uses them
- Composer packages and framework checked against PHP 8.4
- Switch to a patched PHP 8.4 release with rollback kept
From patched PHP 8.2 to PHP 8.4 in 7 days
Day 1: Patch and scan
We install PHP 8.2.35 on your servers first, confirm the fix is live, then scan the code for 8.3 and 8.4 changes.
Days 2-4: Update code
Deprecations are fixed and packages updated on a PHP 8.4 staging copy, with tests run after each change.
Days 5-6: Confirm
We compare key pages, jobs and API responses between the 8.2 and 8.4 builds, and you sign off the staging site.
Day 7: Move to 8.4
Production switches to PHP 8.4 at a quiet time. The patched 8.2.35 setup stays ready as a fallback.
PHP 8.2 (patched) vs PHP 8.4
Even after the 8.2.35 patch, the support dates tell the story.
| PHP 8.2 | PHP 8.4 | |
|---|---|---|
| PHP2Shell | Fixed in 8.2.35 | Fixed in 8.4.27 |
| Security support ends | 31 December 2026 | 31 December 2028 |
| Regular bug fixes | Stopped, security fixes only | Still active until 31 December 2026 |
| Nullable parameter style | Implicit null default accepted | Implicit form deprecated, ?Type expected |
| Class constants | Untyped | Typed class constants |
| Newest features | Readonly classes, DNF types | Property hooks, asymmetric visibility, lazy objects |
Why patch and upgrade with us
Updating the PHP package is easy. Making sure every server, container and FPM pool actually runs the patched build is where teams slip.
We verify the patch is really live
We check the PHP version reported by each web server, worker and cron host, not just the command line, so no old 8.2 build is left serving traffic.
Emergency patch on day one, not day seven.
Fixed price for the full 8.4 upgrade.
PHP 8.2 patching and upgrades for USA and UK businesses
This service is made for companies in the US and the UK running PHP 8.2 that want PHP2Shell closed today and the end-of-year deadline handled without panic. Our team in India works hours that overlap with the US East Coast and the UK working day, with same-day answers.
An NDA is signed before we log in to anything. You get one fixed price for the patch and the upgrade, at offshore rates well below a local agency.
Official sources: PHP supported versions · PHP security releases · PHP 8.4 migration guide
Frequently asked questions
Straight answers about our PHP 8.2 to PHP 8.4 Upgrade service.
Yes. Update to PHP 8.2.35, which contains the fix for both flaws. Do it now. Then plan the move to 8.4, because PHP 8.2 gets no security fixes at all after 31 December 2026.
Because 8.2 has about ten weeks of support left. The next serious PHP flaw after that date will have no 8.2 patch. PHP 8.4 is supported until the end of 2028, so you skip another emergency.
The patch goes on during day one. The full upgrade takes 7 days for most small and medium apps. Very large systems get a phased plan, with the first part live on PHP 8.4 within those same 7 days.
Current WordPress, Laravel and Symfony releases support PHP 8.4. Older plugins or packages may not, and we check and update each one before the switch.
8.3 is patched in 8.3.36 and supported until 31 December 2027. It works, but it only adds one year, and the code changes to reach 8.4 are small, so 8.4 is the better use of the same effort.
Yes. We work with businesses across the United States and United Kingdom, overlap with your working hours, sign an NDA and agree a fixed price first.
Is your PHP app still on an old version?
Send us the URL or the repository. We check it for the PHP2Shell flaw and old code for free, and tell you what a 7-day migration looks like.
Get a free migration audit