Drupal PHP version
Drupal PHP requirements, release by release
Drupal 11.3 and 11.4 run on PHP 8.3, 8.4 and 8.5. Drupal 10.6 runs on 8.1 to 8.4, and Drupal 12.0, still in beta, needs 8.5. Every supported Drupal release can therefore run a PHP build fixed for PHP2Shell, and 8.3.36 or 8.4.27 suits 10.6, 11.3 and 11.4 alike. Drupal 10 ends on 9 December 2026.
Last reviewed against Drupal's PHP requirements, Drupal's release schedule and php.net.
Requirements table
Drupal PHP version support by core release
Drupal sets its PHP range per minor release, not per major, so Drupal 11.2 and Drupal 11.4 accept different PHP versions. Find your minor release in the first column.
| Drupal release | Status on 27 October 2026 | PHP versions supported | PHP2Shell-fixed releases it can run |
|---|---|---|---|
| Drupal 11.4 | Current minor: bug and security fixes. 11.4.11 released 21 October 2026 | 8.3, 8.4 and 8.5 | 8.3.36, 8.4.27 or 8.5.12 |
| Drupal 11.3 | Security fixes until Drupal 12.0 ships (planned for the week of 7 December 2026). 11.3.20 released 21 October 2026 | 8.3, 8.4 and 8.5 | 8.3.36, 8.4.27 or 8.5.12 |
| Drupal 10.6 | The last Drupal 10 minor. Security fixes until Drupal 10 reaches end of life on 9 December 2026. 10.6.20 released 21 October 2026 | 8.1, 8.2, 8.3 and 8.4 (not 8.5) | 8.2.35, 8.3.36 or 8.4.27 |
| Drupal 12.0 | Beta (12.0.0-beta2, 14 October 2026). Not for production yet | 8.5 only | 8.5.12 |
| Drupal 11.1 and 11.2 | Outside the security release window | 8.3 and 8.4 | 8.3.36 or 8.4.27, but update core to 11.3 or 11.4 as well |
| Drupal 10.4 and 10.5 | Outside the security release window | 8.1, 8.2, 8.3 and 8.4 | 8.2.35 to 8.4.27, but update core to 10.6 as well |
| Drupal 7 | End of life since 5 January 2025. Last release 7.103 (4 December 2024) | Up to 8.3, which needs 7.103; 8.4 will never be supported | 8.2.35 or 8.3.36, with no further Drupal 7 fixes |
Drupal's monthly security window currently covers 11.4, 11.3 and 10.6 only. A PHP package from a Linux distribution can carry the PHP2Shell fix under an older-looking version number, so on a distribution build check the vendor's advisory rather than the number: reading backported PHP versions. Branch dates are on PHP end of life dates, and the other platforms are on the PHP version requirements hub.
Sources: Drupal PHP requirements; Drupal core release schedule; Drupal core releases; PHP requirements for Drupal 7
Drupal and PHP2Shell
Two separate jobs this month
PHP2Shell sits beneath Drupal, in the PHP runtime. Drupal's security team published PSA-2026-10-20 on 21 October 2026: if you run PHP yourself, apply the PHP update; if a host runs it, follow the host's instructions. The team was clear that its remit covers code hosted on drupal.org, and that updating PHP is the only complete fix.
CISA added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalogue on 26 October 2026. If your PHP cannot be patched quickly, read whether to take the site offline while you arrange it, and the PHP2Shell reference page for the interim settings.
Not to be confused with SA-CORE-2026-014
One week before PHP2Shell, on 14 October 2026, Drupal published a critical remote code execution advisory for its own Field UI module, CVE-2026-108097. That one is fixed by updating Drupal core, to 10.6.19, 11.3.19 or 11.4.10 or later. Drupal lists uninstalling the core Field UI module as a stopgap until the update is in.
A site on the 21 October core releases (10.6.20, 11.3.20 or 11.4.11) has the Drupal fix. It still needs the PHP fix, which no Drupal release can deliver.
Sources: PSA-2026-10-20; SA-CORE-2026-014
Your starting point
Which PHP move fits your Drupal site
The right PHP target depends on where the site is today and where Drupal is taking it next.
On Drupal 11.3 or 11.4
The widest choice. Patch within the branch you already run, then consider 8.4 or 8.5 as a planned change. PHP 8.5 is the only branch Drupal 12.0 lists, so a site that reaches 8.5 on 11.4 has one less job later.
On Drupal 10.6
Aim for 8.3 or 8.4. Both are fixed, both are accepted by Drupal 10.6, and both are accepted by Drupal 11.4, so one PHP move serves the site before and after its Drupal 11 upgrade. Leave 8.5 until you are on Drupal 11.3 or later; Drupal 10.6 does not support it.
On an older Drupal 10 or 11 minor
Drupal 10.4, 10.5, 11.1 and 11.2 can all run a fixed PHP release, but none of them receives core security releases any more, so they also miss the Field UI fix. Update core within the major first, to 10.6 or 11.4, then change PHP.
Still on Drupal 7
Get to Drupal 7.103 and PHP 8.3.36, the last PHP branch Drupal 7 supports, so at least the runtime is patched. Then treat the migration as urgent: Drupal 7 has had no core security releases since January 2025, and a Drupal 7 site still on PHP 8.1 or older has no PHP2Shell release from the PHP project at all.
Modules, themes and Composer
Drupal core is only half of the compatibility question
Contributed modules, custom code and the Composer packages under them each carry PHP limits of their own.
Module PHP minimums
A module can declare a minimum PHP version with the
php key in its
.info.yml file. Drupal will not
let anyone enable that module on an older PHP, which is one way a
mismatched staging server shows itself. Modules that follow core's
range need no such key, and Drupal's requirements page warns
that some modules ask for extra PHP extensions or settings.
The baseline from Drupal itself: PDO with a database driver, GD, XML (which brings DOM), JSON, and OpenSSL if you use the Update Manager. Drupal needs at least 64MB of PHP memory; 128MB or 256MB is typical in production.
Composer's view of PHP
Composer treats PHP as a platform package. Before the change, ask it which installed packages would refuse the new version; after the change, have it compare the server's real PHP with what is installed.
# Which installed packages would stop a move to PHP 8.4?
composer prohibits php 8.4
# After the switch, compare the server's real PHP with what is installed
composer check-platform-reqs --no-dev
If your composer.json pins
config.platform.php, Composer
resolves packages as if that PHP were installed, whatever the
machine running it has. Keep it equal to the lowest PHP your
production servers will run, and raise it in the same change
as the server move.
{
"config": {
"platform": {
"php": "8.3.36"
}
}
}
Composer warns that a pinned platform can let packages install
that then fail at runtime, and it recommends running
check-platform-reqs as part of
every deployment; that command ignores the pin and reads the
real PHP.
Sources: Drupal .info.yml reference; Composer config; Composer commands
Upgrade steps
Changing the PHP version under a Drupal site
For a patch within your current branch, such as 8.3.x to 8.3.36, steps 1, 4, 6 and 7 are usually enough. Moving to a new branch needs all seven. The server side is covered in how to update PHP.
- 1
Read the status report
Go to Reports, then Status report (
/admin/reports/status). Note the PHP version and PHP memory limit, and deal with anything shown in red before you add a PHP change on top. - 2
Bring core up to date first
Update to the newest patch release of a supported minor, so the PHP range in the table above applies to you. On a site built with
drupal/core-recommended:composer outdated "drupal/*" composer update "drupal/core-*" --with-all-dependencies drush updatedb drush cache:rebuild - 3
Check modules and packages against the target
Run
composer prohibits phpwith your target branch, update or replace anything it names, and read the release notes of custom and contributed modules that declare a PHP range. - 4
Back up code, files and database
drush sql:dump > before-php-change.sql # database only drush archive:dump # code, files and database - 5
Rehearse on a copy
Switch a staging copy to the target PHP first. Compare the loaded extensions in
phpinfo()before and after: a new branch can arrive without an extension the old one had, and Drupal lists GD and a PDO database driver among its requirements. - 6
Switch production inside a maintenance window
drush state:set system.maintenance_mode 1 drush cache:rebuild # ... switch PHP and restart PHP-FPM or Apache here ... drush updatedb drush cache:rebuild drush state:set system.maintenance_mode 0Restart PHP-FPM or Apache, not just reload, so no worker process from the old build keeps serving pages.
- 7
Check the result
Work through the checks in the next section before you close the change.
Confirm it worked
How to tell Drupal is running the fixed PHP
- The status report shows the new version. It is generated by a web request, so it reports the PHP that actually serves your pages: 8.3.36, 8.4.27, 8.5.12 or later, or a distribution package your vendor lists as fixed.
- The terminal agrees, or you know why not.
php -vand Drush use the command-line build, which can differ from the one the web server runs. If they disagree, cron jobs and Drush commands are still on the old build. - Composer is satisfied.
composer check-platform-reqs --no-devreports no failures on the production server. - Nothing new in red. The status report shows no new PHP warnings, and the site's key pages, forms and logins still work.
- Exposure before the patch is checked. If the site faced the internet on a vulnerable build, follow the compromise checks; patching removes nothing an attacker left behind.
Running Drupal alongside other PHP applications? The Joomla, Laravel and Moodle pages cover their own PHP ranges, and checking your PHP version explains each method in more depth.
Drupal questions
Drupal PHP version FAQs
What PHP version does Drupal 10 need?
At least PHP 8.1. Drupal 10.6, the final Drupal 10 minor, runs on 8.1, 8.2, 8.3 and 8.4 but not on 8.5. Since PHP 8.1 has no PHP2Shell release from the PHP project, a Drupal 10 site should be on 8.3 or 8.4 now, which also covers the jump to Drupal 11 before Drupal 10's end of life on 9 December 2026.
Can Drupal 11 run on PHP 8.5?
Yes, from Drupal 11.3 onwards. Drupal 11.3 and 11.4 list 8.3, 8.4 and 8.5. The earlier Drupal 11 minors, 11.1 and 11.2, stop at 8.4, and both are outside Drupal's security release window, so update core before you consider 8.5.
Does Drupal 7 work with PHP 8.3?
Drupal's own Drupal 7 documentation lists PHP 8.3 as supported from Drupal 7.103 and says PHP 8.4 will not be supported. That makes 8.3.36 the newest PHP2Shell release a Drupal 7 site can run. Drupal 7 itself reached end of life on 5 January 2025 and gets no security fixes, so treat this as a holding position while you migrate.
Do I need a Drupal update to fix PHP2Shell?
No. PHP2Shell is in PHP, so the fix is a patched PHP build. Drupal's security team said as much in PSA-2026-10-20. Do not let that hide a separate Drupal core issue: SA-CORE-2026-014, a critical flaw in Field UI published on 14 October 2026, is fixed in Drupal 10.6.19, 11.3.19 and 11.4.10, so a site that has not taken those releases needs both updates.
What PHP version will Drupal 12 need?
Drupal's PHP table lists PHP 8.5 alone for Drupal 12.0, and the requirements page asks for PHP compiled with argon2 support for password hashing. Drupal 12.0 was in beta on 27 October 2026, with its stable release planned for the week of 7 December 2026.
Know your exposure
Find every PHP server you run
Patching the server you know about is the easy part. A vulnerability scan finds the forgotten staging site, the old microsite and the appliance with PHP inside, then tells you which ones are still exposed.