Upgrade PHP 8.0 to 8.4 after PHP2ShellPHP vulnerability · PHP2Shell · CVE-2026-109618 / CVE-2026-109619 · PHP RCE · PHP security update

Plan the PHP vulnerability update and migration separately

First confirm whether your current vendor has a PHP2Shell backport. Then test the move from PHP 8.0 to PHP 8.4. A backport for one PHP vulnerability does not restore upstream support to an end-of-life branch.

Do not change major or minor runtime branches directly on production without application and extension testing.

Review the move to PHP 8.1

These compatibility notes summarize the linked PHP migration guide. Review the complete guide for extension-specific changes.

• What changed

  Writing to the whole $GLOBALS array is no longer supported.

  What to search for in your code

  Whole-array writes to $GLOBALS.

  Read the PHP 8.1 migration source ↗
• What changed

  An optional parameter before a required parameter is treated as required.

  What to search for in your code

  Function signatures with required arguments after defaulted arguments.

  Read the PHP 8.1 migration source ↗
• What changed

  Inherited methods share their static variables with the parent method.

  What to search for in your code

  Static variables in inherited methods.

  Read the PHP 8.1 migration source ↗

Review the move to PHP 8.2

These compatibility notes summarize the linked PHP migration guide. Review the complete guide for extension-specific changes.

• What changed

  Case conversion in standard string functions becomes ASCII-based rather than locale-sensitive.

  What to search for in your code

  strtolower(), strtoupper() and locale-dependent comparisons.

  Read the PHP 8.2 migration source ↗
• What changed

  str_split() returns an empty array for an empty string.

  What to search for in your code

  Code expecting one empty element from str_split().

  Read the PHP 8.2 migration source ↗
• What changed

  glob() returns an empty array when open_basedir restricts every path.

  What to search for in your code

  Strict false checks on glob() results.

  Read the PHP 8.2 migration source ↗

Review the move to PHP 8.3

These compatibility notes summarize the linked PHP migration guide. Review the complete guide for extension-specific changes.

• What changed

  range() rejects invalid boundary types and invalid step values more strictly.

  What to search for in your code

  range() with objects, arrays, zero or negative steps.

  Read the PHP 8.3 migration source ↗
• What changed

  number_format() handles a negative decimals argument by rounding before the decimal point.

  What to search for in your code

  Negative decimals arguments in number_format().

  Read the PHP 8.3 migration source ↗
• What changed

  Date handling uses more specific exception and error classes.

  What to search for in your code

  DateTime construction and exception handlers.

  Read the PHP 8.3 migration source ↗

Review the move to PHP 8.4

These compatibility notes summarize the linked PHP migration guide. Review the complete guide for extension-specific changes.

• What changed

  exit() and die() use ordinary type coercion and can throw TypeError for invalid inputs.

  What to search for in your code

  exit() or die() calls with non-string, non-integer values.

  Read the PHP 8.4 migration source ↗
• What changed

  The PHP_DEBUG and PHP_ZTS constants become booleans.

  What to search for in your code

  Strict comparisons between these constants and integers.

  Read the PHP 8.4 migration source ↗
• What changed

  round() throws ValueError for invalid rounding modes.

  What to search for in your code

  Custom or dynamically selected rounding modes.

  Read the PHP 8.4 migration source ↗

Before switching the runtime

• Back up application files, configuration and data, and verify you can restore them.
• Test in staging with the target runtime and the same extensions used in production.
• Review dependency constraints and application, plugin and theme compatibility.
• Exercise login, uploads, mail, scheduled tasks, queues and failure paths.
• Confirm the target package includes the PHP vulnerability fix and remains supported.

Choose your platform update route

Rollback and recovery

Keep known package or image references and a tested restore procedure. Restore configuration and application data consistently if the migration fails. Reverting to a vulnerable runtime reintroduces the PHP vulnerability; review the vendor advisory before exposing that runtime to web traffic.