PHP2Shell, two critical PHP flaws (CVSS 9.2), went public on October 21, 2026, and an exploit attempt was recorded four days before the fix. PHP 8.3 has an official fix in PHP 8.3.36, so install that release first. Its security fixes end on December 31, 2027. Moving to PHP 8.4 adds a year of security support, and for most small and mid-sized apps that is a 7-day job. Read about PHP2Shell.
PHP 8.3 needs less work to reach 8.4 than any other PHP version in use. PHP 8.3 to PHP 8.4 upgrade services begin by confirming the 8.3.36 security release on every server, then make the short hop to PHP 8.4 at a pace that suits your release schedule, for teams in the US.
PHP 8.3 is not an emergency once patched. Its security support runs until December 31, 2027. Its regular bug fix phase ended on December 31, 2025, so ordinary PHP bugs no longer get fixed. PHP 8.4 still receives regular bug fixes until the end of 2026 and security releases until the end of 2028.
The changes between the two are short. PHP 8.4 deprecated implicitly nullable parameter types, the E_STRICT constant, trigger_error() with E_USER_ERROR, mysqli_ping() and mysqli_refresh(), plus the session.sid_length and session.sid_bits_per_character settings. It also moved the IMAP, OCI8, PDO_OCI and Pspell extensions to PECL and raised the default bcrypt cost from 10 to 12.
Is moving from 8.3 to 8.4 worth it?
For most apps, yes, because the step is small now and only gets bigger the longer it waits.
One more year of security cover
Support moves from December 31, 2027 to December 31, 2028, and PHP 8.4.27 contains the same PHP2Shell fix as 8.3.36.
Bug fixes resume
PHP 8.4 is still in active support through 2026, so non-security bugs you hit in PHP itself can still be fixed upstream.
Property hooks and cleaner classes
Property hooks and asymmetric visibility let your team drop piles of getter and setter boilerplate. array_find(), array_any() and array_all() tidy up common loops.
Scope of a PHP 8.3 upgrade
- PHP 8.3.36 installed first on every server and container
- Compatibility scan for every PHP 8.4 deprecation
- Function signatures like Foo $x = null changed to ?Foo $x = null
- trigger_error() with E_USER_ERROR replaced by exceptions
- E_STRICT references removed from error handling code
- IMAP, OCI8 or Pspell usage moved to PECL or a library
- Session settings and mysqli_ping() calls reviewed
- Rollout to PHP 8.4 with a rollback image kept
The 7-day timeline for PHP 8.3
Day 1: Secure and assess
PHP 8.3.36 goes live on day one. Then the app runs on 8.4 with deprecation logging on, and the work gets sized.
Days 2-4: Adjust
Nullable signatures, error handling and any unbundled extensions are fixed, and Composer packages are refreshed.
Days 5-6: Validate
Tests and manual checks run on PHP 8.4 staging, and we compare login, payment and API results with the 8.3 build.
Day 7: Promote
At a calm hour, production moves to PHP 8.4, logs stay under watch, and the 8.3.36 build remains the fallback.
PHP 8.3 compared to PHP 8.4
Close cousins, with a year of difference in support and a few handy new tools.
| PHP 8.3 | PHP 8.4 | |
|---|---|---|
| PHP2Shell fix | PHP 8.3.36 | PHP 8.4.27 |
| Active bug fixes | Ended December 31, 2025 | Until December 31, 2026 |
| Security fixes | Until December 31, 2027 | Until December 31, 2028 |
| Getters and setters | Written by hand | Property hooks and asymmetric visibility |
| HTML parsing | DOMDocument with HTML4 rules | New Dom\HTMLDocument with HTML5 parsing |
| Bundled extensions | IMAP, OCI8, Pspell included | Moved out to PECL |
Why let us handle the 8.3 to 8.4 step
Small upgrades still go wrong when nobody checks the edges: a cron box left on an old build, a mailbox reader that needs IMAP.
Every host checked
The checklist covers each web server, queue worker and scheduled job, confirming the patched build before and after the move.
Honest advice if patching alone is enough for now.
Fixed price agreed before any change.
PHP 8.3 to 8.4 upgrades for companies in the USA
US teams on PHP 8.3 get the patch checked and the 8.4 move done without pulling developers off product work. Techno Mantra is an AI and web development company that builds AI applications, websites, SEO programs and custom CRM systems for businesses in the US, Canada and Australia.
Work can start after an NDA, at one fixed price, with replies within one business day.
Official sources: PHP supported versions · PHP security releases · PHP 8.4 migration guide
Frequently asked questions
Straight answers about our PHP 8.3 to PHP 8.4 Upgrade service.
Yes. PHP 8.3.36 contains the fix for both CVE-2026-109618 and CVE-2026-109619. Install it now on every server, worker and container that runs your code.
Not urgently once 8.3.36 is in place. 8.3 keeps getting security fixes until December 31, 2027. Upgrading now is a planning choice: the work is small, and it adds a year of cover plus bug fixes.
Most small and mid-sized apps finish within 7 days. A large system follows a phased plan, with its first module on PHP 8.4 before day seven ends.
Not much. The usual items are implicitly nullable parameters, error handlers that use E_STRICT or E_USER_ERROR, and any code that relies on IMAP or OCI8, which are no longer bundled with PHP.
Yes. Existing hashes verify as before. Only new hashes use the higher default cost of 12, which makes them a little harder to crack.
Yes. US teams work with one project manager, sign an NDA if they want one, and settle the price before work begins.
Is your PHP app still on an old version?
Send the URL or repository, under NDA if needed. The audit checks for the PHP2Shell flaw and outdated code and shows what a 7-day migration looks like.
Request a migration audit