PHP2Shell, two critical PHP flaws (CVSS 9.2), went public with fixes on October 21, 2026, after an exploit attempt was recorded four days earlier. PHP 8.2 has an official fix: install PHP 8.2.35 now. Its security support still ends on December 31, 2026, and any flaw found after that date gets no 8.2 release. PHP 8.4 is supported until December 31, 2028, and most small and mid-sized apps move to it in 7 days. See how to update PHP safely.
PHP 8.2 to PHP 8.4 upgrade services start with an official fix older PHP sites lack: PHP 8.2.35, which you can install today to close PHP2Shell. The service confirms 8.2.35 is live on every server on day one, then moves US apps to PHP 8.4 before 8.2 support runs out.
The deadline is close. PHP 8.2 security support ends on December 31, 2026. After that date, a new PHP flaw gets no 8.2 release. PHP 8.4 keeps receiving security releases until December 31, 2028.
The code changes from 8.2 to 8.4 are modest. PHP 8.3 deprecated get_class() and get_parent_class() without an argument and deprecated assert_options(). PHP 8.4 deprecated implicitly nullable parameter types, the E_STRICT constant and trigger_error() with E_USER_ERROR, deprecated mysqli_ping(), and moved IMAP, OCI8 and Pspell out of the core. Most apps clear this list well inside a week.
Patch now, but plan for PHP 8.4
PHP 8.2.35 closes PHP2Shell. PHP 8.4 solves the support cut-off at the end of 2026.
Two extra years of fixes
Moving from 8.2 to 8.4 shifts your security end date from December 31, 2026 to December 31, 2028, and 8.4.27 already includes the PHP2Shell fix.
One upgrade instead of two
Going to 8.3 would only buy one more year. Jumping straight to 8.4 covers both releases' changes in the same week of work.
New features for your developers
Typed class constants, json_validate() and #[\Override] from 8.3, plus property hooks, asymmetric visibility and array_find() from 8.4.
What the PHP 8.2 service includes
- PHP 8.2.35 installed on day one for PHP2Shell
- Check that your web server loads the patched build
- Scan for PHP 8.3 and PHP 8.4 deprecations
- Implicitly nullable parameters rewritten as explicit ?Type
- get_class(), assert_options() and E_STRICT usage cleaned up
- IMAP or OCI8 code handled if your app uses them
- Composer packages and framework checked against PHP 8.4
- Switch to a patched PHP 8.4 release with rollback kept
From patched PHP 8.2 to PHP 8.4 in 7 days
Day 1: Patch and scan
PHP 8.2.35 goes onto your servers first, the fix is confirmed live, and a scan covers the 8.3 and 8.4 changes.
Days 2-4: Update code
Deprecations are fixed and packages updated on a PHP 8.4 staging copy, with tests run after each change.
Days 5-6: Confirm
Key pages, jobs and API responses are compared between the 8.2 and 8.4 builds, and you approve the staging site.
Day 7: Move to 8.4
Production switches to PHP 8.4 at a quiet time. The patched 8.2.35 setup stays ready as a fallback.
PHP 8.2 (patched) vs PHP 8.4
Once 8.2.35 is installed, the difference is how long support lasts.
| PHP 8.2 | PHP 8.4 | |
|---|---|---|
| PHP2Shell | Fixed in 8.2.35 | Fixed in 8.4.27 |
| Security support ends | December 31, 2026 | December 31, 2028 |
| Regular bug fixes | Stopped, security fixes only | Still active until December 31, 2026 |
| Nullable parameter style | Implicit null default accepted | Implicit form deprecated, ?Type expected |
| Class constants | Untyped | Typed class constants |
| Newest features | Readonly classes, DNF types | Property hooks, asymmetric visibility, lazy objects |
Why patch and upgrade with us
Updating the PHP package is easy. Making sure every server, container and FPM pool runs the patched build is where teams slip.
Patch verified on every host
Each web server, worker and cron host reports its own PHP version, and each gets checked beyond the command line, so no old 8.2 build keeps serving traffic.
The patch is verified before any upgrade work.
Fixed price for the full 8.4 upgrade.
PHP 8.2 patching and upgrades for US businesses
The service is built for US companies on PHP 8.2 facing the December 31 deadline. Techno Mantra is an AI and web development company that builds AI applications, websites, SEO programs and custom CRM systems for businesses in the US, Canada and Australia.
An NDA can come first, before anyone logs in. One fixed price covers the patch and the upgrade, and every message gets a reply within one business day.
Official sources: PHP supported versions · PHP security releases · PHP 8.4 migration guide
Frequently asked questions
Straight answers about our PHP 8.2 to PHP 8.4 Upgrade service.
Yes. PHP 8.2.35 contains the official fix for both flaws, and you can install it today. Then plan the move to 8.4, because PHP 8.2 gets no security fixes after 2026.
Because support for 8.2 ends about ten weeks after PHP2Shell went public. The next serious flaw found in 2027 will have no 8.2 patch, and PHP 8.4 stays supported until the end of 2028.
Seven days for most small and mid-sized apps, patch check included. Large systems move in phases, and the first phase reaches PHP 8.4 within those 7 days.
Current WordPress, Laravel and Symfony releases support PHP 8.4. Older plugins or packages may not, so each one gets checked and updated before the switch.
It works, but 8.4 is the better use of the effort. PHP 8.3.36 carries the fix and 8.3 is supported until December 31, 2027, one year more than 8.2, while the extra code changes for 8.4 are small.
Yes. US businesses get the 8.2.35 check, the full 8.4 upgrade and an NDA on request, with call times overlapping US Eastern hours.
Is your PHP app still on an old version?
Send the URL or repository, under NDA if needed. The audit checks for the PHP2Shell flaw and outdated code and shows what a 7-day migration looks like.
Request a migration audit