Is my PHP version still safe? · End of life
Is PHP 8.1 still safe?
PHP 8.1 is past its php.net end-of-life date, so the PHP project no longer ships releases for it, including for the October 2026 PHP2Shell bugs.
Last updated
Status at a glance
| Item | Value |
|---|---|
| End of life (php.net) | 2025-12-31 |
| Last php.net release | 8.1.34 |
| PHP2Shell (CVE-2026-109618/109619) | No official php.net release; minimal source backports only (see PHP 5 through 8.1) |
| Verified distro backports | Ubuntu 22.04 php8.1 8.1.2-1ubuntu2.28 · Amazon Linux 2023 php8.1: no fix planned |
What to do
Upgrade to 8.4 or 8.5. If you cannot yet, use a vendor that still patches 8.1 (a distro LTS or commercial support), keep the site off the public internet where possible, and see remediation for interim limits.
Other PHP branches
- PHP 8.5Supported · PHP2Shell: 8.5.12
- PHP 8.4Supported · PHP2Shell: 8.4.27
- PHP 8.3Security fixes only · PHP2Shell: 8.3.36
- PHP 8.2Security support ends 2026-12-31 · PHP2Shell: 8.2.35
- PHP 8.0End of life
- PHP 7.4End of life
Is PHP 8.1 affected by PHP2Shell?
The PHP project published no official 8.1 release for these CVEs. Public write-ups disagree on how far back the bugs reach, so treat 8.1 as at risk.
When did PHP 8.1 reach end of life?
On 2025-12-31, according to php.net. The last official release was 8.1.34.
Can I keep running PHP 8.1?
Only if a vendor still ships security fixes for it and you install them. Otherwise upgrade.
Sources
Outbound links leave this site. We do not host exploit code.
- Supported Versions — PHP project (php.net)
- Unsupported Branches — PHP project (php.net)
- News archive 2026: security advisory, 21 October 2026 — PHP project (php.net)
- CVE-2026-109618 — Ubuntu Security (Canonical)
- CVE-2026-109618 — Amazon Linux Security Center