PHP2Shell, the worst PHP security flaw in years, went public on 21 October 2026, and attackers were already testing it beforehand. If you run PHP 8.3, you are covered once you install PHP 8.3.36, so do that first. PHP 8.3 already gets security fixes only, and those end on 31 December 2027. Don't worry: we patch you today and can upgrade the app to PHP 8.4 in 7 days. Read about PHP2Shell.
Of every PHP version still in use, 8.3 needs the least work to reach 8.4. Our PHP 8.3 to PHP 8.4 upgrade services in USA and UK keep it that way: we apply the PHP 8.3.36 security release straight away, then make the short hop to PHP 8.4 at a pace that suits your release schedule.
To be straight with you, PHP 8.3 is not an emergency once patched. Its security support runs until 31 December 2027. But its regular bug fix phase ended in December 2025, so ordinary bugs no longer get fixed, and each passing month brings the next deadline closer. PHP 8.4 still receives regular bug fixes until the end of 2026 and security releases until the end of 2028.
The changes between the two are short. PHP 8.4 deprecated implicitly nullable parameter types, the E_STRICT constant, trigger_error() with E_USER_ERROR, mysqli_ping() and mysqli_refresh(), plus the session.sid_length and session.sid_bits_per_character settings. It also moved the IMAP, OCI8, PDO_OCI and Pspell extensions to PECL and raised the default bcrypt cost from 10 to 12.
Is moving from 8.3 to 8.4 worth it?
For most apps, yes, because the step is small now and only gets bigger the longer it waits.
One more year of security cover
Support moves from 31 December 2027 to 31 December 2028, and PHP 8.4.27 contains the same PHP2Shell fix as 8.3.36.
Bug fixes resume
PHP 8.4 is still in active support through 2026, so non-security bugs you hit in PHP itself can still be fixed upstream.
Property hooks and cleaner classes
Property hooks and asymmetric visibility let your team drop piles of getter and setter boilerplate. array_find(), array_any() and array_all() tidy up common loops.
Scope of a PHP 8.3 to 8.4 upgrade
- PHP 8.3.36 installed first on every server and container
- Compatibility scan for every PHP 8.4 deprecation
- Function signatures like Foo $x = null changed to ?Foo $x = null
- trigger_error() with E_USER_ERROR replaced by exceptions
- E_STRICT references removed from error handling code
- IMAP, OCI8 or Pspell usage moved to PECL or a library
- Session settings and mysqli_ping() calls reviewed
- Rollout to PHP 8.4 with a rollback image kept
Our 7-day PHP 8.3 to 8.4 timeline
Day 1: Secure and assess
PHP 8.3.36 goes live on day one. We then run the app on 8.4 with deprecation logging on and size the work.
Days 2-4: Adjust
Nullable signatures, error handling and any unbundled extensions are fixed, and Composer packages are refreshed.
Days 5-6: Validate
Tests and manual checks run on PHP 8.4 staging, and we compare login, payment and API results with the 8.3 build.
Day 7: Promote
We roll PHP 8.4 into production at a calm hour, watch logs and keep the 8.3.36 build ready to fall back to.
PHP 8.3 compared to PHP 8.4
Close cousins, with a year of difference in support and a few handy new tools.
| PHP 8.3 | PHP 8.4 | |
|---|---|---|
| PHP2Shell fix | PHP 8.3.36 | PHP 8.4.27 |
| Active bug fixes | Ended 31 December 2025 | Until 31 December 2026 |
| Security fixes | Until 31 December 2027 | Until 31 December 2028 |
| Getters and setters | Written by hand | Property hooks and asymmetric visibility |
| HTML parsing | DOMDocument with HTML4 rules | New Dom\HTMLDocument with HTML5 parsing |
| Bundled extensions | IMAP, OCI8, Pspell included | Moved out to PECL |
Why let us handle the 8.3 to 8.4 step
Small upgrades still go wrong when nobody checks the edges: a cron box left on an old build, a mailbox reader that needs IMAP.
Every host checked
We list each web server, queue worker and scheduled job, and confirm all of them run the patched build before and after the move.
Honest advice if patching alone is enough for now.
Fixed price agreed before any change.
PHP 8.3 to 8.4 upgrades for companies in the USA and UK
This offer suits US and UK teams on PHP 8.3 who want the PHP2Shell patch confirmed today and the 8.4 move done without pulling developers off product work. We are based in India and keep hours that overlap with the East Coast and with the UK office day, replying the same day.
Work starts after an NDA, at one fixed price, at an offshore rate far below local contractor fees.
Official sources: PHP supported versions · PHP security releases · PHP 8.4 migration guide
Frequently asked questions
Straight answers about our PHP 8.3 to PHP 8.4 Upgrade service.
Yes. PHP 8.3.36 contains the fix for both CVE-2026-109618 and CVE-2026-109619. Install it now on every server, worker and container that runs your code.
Not urgently once 8.3.36 is in place. 8.3 keeps getting security fixes until 31 December 2027. Upgrading now is a planning choice: the work is small, and it adds a year of cover and bug fixes.
Most small and medium apps are finished in 7 days, often sooner. Very large systems get a phased plan where the first part moves to PHP 8.4 within the same 7 days.
Very little. The usual items are implicitly nullable parameters, error handlers that use E_STRICT or E_USER_ERROR, and any code that relies on IMAP or OCI8, which are no longer bundled with PHP.
Yes. Existing hashes verify as before. Only new hashes use the higher default cost of 12, which makes them a little harder to crack.
Yes. We patch and upgrade PHP apps for companies across the United States and United Kingdom, overlap with your hours and agree a fixed price under NDA.
Is your PHP app still on an old version?
Send us the URL or the repository. We check it for the PHP2Shell flaw and old code for free, and tell you what a 7-day migration looks like.
Get a free migration audit