Platform requirements
PHP version requirements by platform
PHP2Shell is fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Whether you can move to one of them depends on the application running on top of PHP. This page shows, for each major PHP platform, the current release, the PHP versions it supports and the route to a fixed branch.
Last reviewed against php.net and each platform's official documentation.
At a glance
Which fixed PHP branch can my platform run?
"Fixed branch" means 8.2, 8.3, 8.4 or 8.5, the four branches with a PHP2Shell release from the PHP project. PHP 8.2 is fixed but reaches end of life on 31 December 2026, so treat it as a stop on the way, not a destination.
| Platform | Current release | PHP versions supported | Can run a fixed branch? | Upgrade route |
|---|---|---|---|---|
| Magento Open Source and Adobe Commerce | 2.4.9 (May 2026) | 2.4.9: 8.52.4.8: 8.3 and 8.42.4.7: 8.2 and 8.32.4.6: 8.1 and 8.22.4.5 and 2.4.4: 8.1 only | From 2.4.6 | 2.4.4 and 2.4.5 stores need a Magento upgrade before they can leave PHP 8.1. |
| Magento 1 and OpenMage | OpenMage 20.19.0 (26 Oct 2026); Magento 1 itself is outside Adobe's lifecycle policy | OpenMage 20.x: 8.1 and later, up to 8.58.4 and 8.5 may log warnings | Yes, on current OpenMage | Move to a current OpenMage 20.x release on PHP 8.3 or later, or off the platform. |
| Drupal | 11.4.11 (21 Oct 2026); 10.6.20 | 11.3 and 11.4: 8.3 to 8.510.6: 8.1 to 8.412.0 (beta): 8.5 | Yes | Drupal 10.6 runs on 8.3 and 8.4, so the PHP move can come before Drupal 11. Drupal 10 reaches end of life on 9 December 2026. |
| Joomla | 6.2.0 (13 Oct 2026); 5.4.10 | 6.x: 8.3 minimum, 8.4 recommended5.x: 8.1 minimum, 8.3 recommended | Yes | Joomla 5.4 sites can run PHP 8.3 now; 5.4 to 6.2 is an upgrade, not a migration. |
| Laravel | 13.x (13.38.0, 20 Oct 2026) | 13: 8.3 to 8.512: 8.2 to 8.511: 8.2 to 8.410: 8.1 to 8.3 | Yes | Laravel 10 and 11 are past security support: move to 12 or 13. |
| Moodle | 5.3 LTS (5 Oct 2026) | 5.2 and 5.3: 8.3 to 8.45.0 and 5.1: 8.2 to 8.44.5 LTS: 8.1 to 8.3 | Yes | Moodle 4.5 LTS sites can move to PHP 8.3 without a Moodle upgrade. |
| PrestaShop | 9.2.0 (30 Sep 2026) | 9.1 and 9.2: 8.1 to 8.59.0: 8.1 to 8.48.0 to 8.2: 7.2 to 8.1 | PrestaShop 9 only | PrestaShop 8 and 1.7 shops cannot run any fixed branch: patched PHP build now, PrestaShop 9 next. |
| Nextcloud | 35.0.2 (15 Oct 2026) | 35: 8.3 to 8.5, 8.5 recommended33 and 34: 8.2 (deprecated) to 8.5 | Yes | Upgrade one major release at a time, after the PHP move. |
| WordPress | 7.1.3 (6 Oct 2026) | 7.1: 7.4 to 8.58.3 or greater recommended | Yes | Covered in full on the WordPress guide. |
| WooCommerce | Runs on WordPress; see the WooCommerce page | 8.3 or greater recommendedTested up to 8.4 | Yes | Patch to the fixed release on 8.3 or 8.4; move to 8.5 once your extensions support it. |
Each row was checked against the platform's own documentation on the review date; every platform has its own page with the detail and sources. For the branch dates themselves, see PHP end of life dates.
Platform guides
Every platform, in detail
Each guide covers the platform's current releases, the PHP versions they accept, the upgrade steps and how to confirm the change.
Magento and Adobe Commerce
Which 2.4 release runs which PHP, and the 2.4.4 and 2.4.5 stores held on 8.1.
Magento 1 and OpenMage
Original Magento 1 against current OpenMage 20.x, and the risk to card-handling shops.
PrestaShop
Why PrestaShop 8 cannot reach a fixed branch, and the route through PrestaShop 9.
WooCommerce
The shop's PHP recommendation, gateway compatibility and the status report.
Drupal
PHP ranges for Drupal 10 and 11, and moving PHP before the core upgrade.
Joomla
Joomla 5 and 6 requirements, extension limits and the pre-update check.
Laravel
Release support windows, Composer constraints and restarting long-running workers.
Moodle
PHP ranges per release for schools, colleges and universities, and the environment check.
Nextcloud
Supported PHP per release, the admin overview warnings and occ.
Order of work
PHP first, or the platform first?
The table above settles it for most sites.
- Your current release supports a fixed branch. Change PHP first. It is the smaller job and it closes PHP2Shell. This covers Drupal 10.6, Joomla 5.4, Moodle 4.5, Nextcloud 33 to 35, Laravel 10 and later, Magento 2.4.6 and later, and current OpenMage.
- It does not. PrestaShop 8 and 1.7, Magento 2.4.4 and 2.4.5, and original Magento 1 on old PHP fall here. Get a PHP build with the fix backported for the version you run, from your Linux distribution, host or a long-term support vendor, or restrict access to the site, and plan the platform upgrade straight away.
- Either way, test on a copy. Extensions, modules and themes have PHP limits of their own, which can be tighter than the platform's.
For the server side of the change, see how to update PHP; for retired branches and backports, the options for old PHP versions.
Quick answers
Platform PHP questions, answered
Which platforms cannot run a fixed PHP branch?
On their own documentation, PrestaShop 8.0 to 8.2 support PHP 7.2 to 8.1, and Adobe lists Magento 2.4.4 and 2.4.5 with PHP 8.1 only. PHP 8.1 gets no fix from the PHP project, so those sites need a backported PHP build now and a platform upgrade next.
My platform cannot run a fixed PHP branch. What now?
Two tracks at once. For now, get a PHP build that carries the fix for the version you run, from your Linux distribution, host or a long-term support vendor, or restrict access to the site. Then plan the platform upgrade that lets you move to a supported branch.
Is PHP 8.2 a safe target for a platform upgrade?
Only as a short stop. PHP 8.2.35 fixes PHP2Shell, but the branch reaches end of life on 31 December 2026 and gets no fixes after that. If your platform also supports 8.3 or later, aim there instead.
Where do these requirements come from?
Each platform's own documentation, checked on the review date shown at the top of each page. Platforms change their supported PHP ranges with new releases, so the platform pages carry their own sources and dates.
What about WordPress?
WordPress 7.1 supports PHP 7.4 to 8.5, and wordpress.org recommends 8.3 or greater. The WordPress guide covers the control panel steps, plugin testing and WooCommerce.
Know your exposure
Find every PHP server you run
Patching the server you know about is the easy part. A vulnerability scan finds the forgotten staging site, the old microsite and the appliance with PHP inside, then tells you which ones are still exposed.