Joomla PHP version
Joomla PHP requirements for Joomla 6, 5 and 4
Joomla 6 needs PHP 8.3 or later and recommends 8.4. Joomla 5 needs 8.1 and recommends 8.3, and both lines fully support PHP 8.5 from 5.4.2 and 6.0.2. Any current Joomla site can therefore move to a PHP release fixed for PHP2Shell. Joomla 4 is no longer supported; its manual recommends 8.2.
Last reviewed against Joomla's technical requirements, the Joomla roadmap and php.net.
Requirements table
Joomla PHP requirements by release line
Joomla publishes a minimum and a recommended PHP version for each major line. The minimum is the floor Joomla guarantees; the recommended version is the one it expects you to run.
| Joomla line | Latest release | Support | Minimum PHP | Recommended PHP | Newest PHP supported | PHP2Shell-fixed releases it can run |
|---|---|---|---|---|---|---|
| Joomla 6 | 6.2.0, released 13 October 2026 | Bug fixes until 17 October 2028; security fixes until 16 October 2029 | 8.3.0 | 8.4 | 8.5, fully supported from 6.0.2 | 8.3.36, 8.4.27 or 8.5.12 |
| Joomla 5 | 5.4.10, released 13 October 2026 (the last 5.x bug fix release) | Security fixes only, until 12 October 2027 | 8.1.0 | 8.3 | 8.4 since 5.2.0; 8.5 fully supported from 5.4.2 | 8.2.35, 8.3.36, 8.4.27 or 8.5.12 |
| Joomla 4 | 4.4.14, released 30 September 2025 | No longer supported | 7.2.5 | 8.2 | Nothing above 8.2 is documented | 8.2.35, its recommended branch |
The fixed releases are the PHP project's 21 October 2026 builds. A host or Linux distribution may ship the fix under a different version string, so ask which build you have rather than trusting the number alone; the Linux guide explains why. Other platforms are listed on the PHP version requirements hub.
Sources: Joomla 6 technical requirements; Joomla 5; Joomla 4; Joomla roadmap; PHP 8.5 support; Joomla downloads
Joomla and PHP2Shell
Joomla Update cannot patch PHP for you
The Joomla Update screen replaces Joomla's own code. The PHP build beneath it belongs to your server, or to your host on shared and managed hosting. Joomla 6.2.0 and 5.4.10 shipped on 13 October 2026, eight days before the PHP fixes, so no Joomla release changes your exposure to PHP2Shell.
The PHP project rates sites running PHP as an Apache module,
mod_php, as the highest risk. Joomla's System Information
screen tells you which setup you have in its "WebServer to PHP
Interface" line: apache2handler
means mod_php, while fpm-fcgi
means PHP-FPM. Either way the fix is the same, and both CVEs
have been on CISA's Known Exploited Vulnerabilities catalogue
since 26 October 2026. See the
PHP2Shell reference page
for the full picture.
The Joomla 5 timing problem
Joomla 5.4.10 was the final bug fix release for Joomla 5, which now gets security fixes only, until 12 October 2027. PHP 8.2 stops getting security fixes much sooner, on 31 December 2026. A Joomla 5 site on PHP 8.2 would lose its PHP support more than nine months before its Joomla support.
PHP 8.3.36 avoids that. It is on the branch Joomla 5 recommends, the minimum Joomla 6 needs, and PHP 8.3 keeps security support until 31 December 2027, so the same PHP carries the site through its Joomla 6 upgrade.
PHP end of life datesChoose your route
The PHP target for each kind of Joomla site
A Joomla 6 site
Already on 8.3 or later by definition. Install the fixed release for your branch: 8.3.36, 8.4.27 or 8.5.12. If you are choosing a branch afresh, Joomla recommends 8.4.
A Joomla 5 site
Update Joomla to 5.4.10 first, then move PHP to 8.3.36. A site still on PHP 8.1 has no PHP2Shell release from the PHP project, so this is the urgent case. Joomla describes 5.4 to 6.2 as an upgrade rather than a migration, which makes Joomla 6 the next planned step.
A Joomla 4 site
Joomla 4 ended with 4.4.14 and no longer receives updates. Get PHP onto 8.2.35, the branch its manual recommends, then upgrade to 5.4 and on to 6. Joomla 4's floor was PHP 7.2.5, so check the branch first: anything below 8.2 has no PHP2Shell release from the PHP project, only source backports for those who build PHP themselves.
A site full of extensions
Extensions can set the pace. Extension developers can publish a minimum PHP version in their update feed, and Joomla then shows the update as available but refuses to install it on an older PHP. Moving PHP can unlock updates that were stuck, so check for extension updates again afterwards.
Extension compatibility
Using Joomla's pre-update check
Before a jump to a new minor or major version, Joomla Update runs a pre-update check against your server and your installed extensions. It is the closest thing Joomla has to a compatibility report, and it has limits worth knowing.
What it checks
- Required Settings: includes the PHP version. If yours is below the target release's minimum, Joomla says so and the update cannot go ahead.
- Recommended Settings: PHP settings Joomla prefers. Joomla still runs if these do not match.
- Extensions: each third-party extension is labelled from its developer's update feed, from "No Update Required" through "Update Required" to "Update Information Unavailable" or "Missing Compatibility Tag".
To preview the check for the next major version without installing anything, open System, Update, Joomla, then Options, and set the Update Channel to "Joomla Next".
Where it falls short
The extension list is only as good as the information each developer publishes. Joomla's own Joomla 5 to 6 guide calls it a very high-level overview and points you to System, Manage, Extensions, the developer's site and your own testing for the real answer. An extension marked "Missing Compatibility Tag" may still work; its developer simply has not told Joomla.
For the Joomla 6 upgrade itself, the guide adds two plugin steps: disable the older "Behaviour - Backward Compatibility" plugin (the one without a number) before upgrading, and rely on "Behaviour - Backward Compatibility 6", which Joomla says keeps most extensions working on 6.2.
Sources: Joomla 5 to 6 upgrade guide; Joomla update server documentation; Joomla 6.2 release notes
Upgrade steps
Moving a Joomla site to a fixed PHP release
These steps change PHP under the Joomla version you already run. If you manage the server yourself, the PHP installation is covered in how to update PHP; on shared hosting, the change is made in your control panel or by your host.
- Record where you start. Open System, then System Information. Note the PHP Version and the WebServer to PHP Interface, and use "Download as text" to keep a copy of the whole screen for comparison later.
- Update Joomla within its line. Use System, Update, Joomla to reach the newest release of your line (6.2.0 or 5.4.10 on 27 October 2026), so the PHP range in the table applies.
- Check every extension. Update each one, then read its developer's stated PHP range for the branch you are moving to. Templates count too.
- Back up, and prove the backup. Joomla's upgrade guide asks for a backup and a test that it restores. Do both before any PHP change.
- Rehearse on a copy with Debug on. Switch PHP on a staging copy, turn on Debug in Global Configuration (System tab), and work through the front end and the administrator. Look at the PHP Settings tab in System Information for anything Joomla flags.
- Change the live site. Switch PHP, restart PHP so no process from the old build is left serving pages, then load the site and the administrator.
- Turn Debug off and confirm. Make sure Debug is off on the live site and run the checks in the next section.
Confirm it worked
Reading the result in System Information
Go back to System, then System Information, and compare it with the copy you downloaded in step 1.
- PHP Version shows 8.3.36, 8.4.27, 8.5.12 or later on its branch. On a host or distribution build with a different number, keep the host's or vendor's written confirmation that it carries the PHP2Shell fix.
- WebServer to PHP Interface is what you expect. If the host also moved you from mod_php to PHP-FPM, this line is where it shows.
- The PHP Information tab shows the full phpinfo output, including the loaded extensions. Compare it with your earlier copy so nothing Joomla needs has gone missing.
- Extension updates that a PHP minimum held back can now be installed, so check for updates once more.
- The exposure window is reviewed. A site that ran a vulnerable PHP build in public should go through the compromise checks, and a site you cannot patch quickly should be weighed against taking it offline.
Moving between content platforms? The Drupal PHP requirements work per minor release, and the WordPress guide covers Site Health and plugin testing.
Screen labels as shown in Joomla 5.4 and 6.2.
Joomla questions
Joomla PHP version FAQs
What PHP version does Joomla 5 need?
PHP 8.1.0 at minimum, with 8.3 recommended in Joomla's technical requirements. Joomla 5.2 added full PHP 8.4 compatibility, and 5.4.2 and later fully support PHP 8.5. For PHP2Shell, 8.3.36 is the sensible target: it is the branch Joomla 5 recommends and the minimum Joomla 6 accepts.
What PHP version does Joomla 6 need?
PHP 8.3.0 or later, with 8.4 recommended. Joomla 6.0.2 and later fully support PHP 8.5 as well. The fixed releases a Joomla 6 site can use are 8.3.36, 8.4.27 and 8.5.12.
Can a Joomla 4 site run a fixed PHP release?
PHP 8.2.35 is fixed and is the branch the archived Joomla 4 manual recommends, so that is the safe holding position. Joomla documents nothing above 8.2 for Joomla 4, PHP 8.2 itself reaches end of life on 31 December 2026, and Joomla 4 no longer receives updates. Plan the move to 5.4 and then 6 now.
Why does Joomla Update say my PHP version is not supported?
Joomla has found a newer release whose minimum PHP is higher than the one your server runs. A Joomla 5 site on PHP 8.1 or 8.2 sees this for Joomla 6, which needs 8.3. Move PHP first, then run the update. A second message exists for the opposite case, where your PHP is newer than the release supports.
Does updating Joomla fix PHP2Shell?
No. Joomla Update replaces Joomla's own files; the PHP version underneath is set by your server or host. A site on Joomla 6.2.0 still needs a patched PHP build, and a host-managed site needs the host to install it.
Know your exposure
Find every PHP server you run
Patching the server you know about is the easy part. A vulnerability scan finds the forgotten staging site, the old microsite and the appliance with PHP inside, then tells you which ones are still exposed.