Moodle PHP version
Moodle PHP requirements for every supported release
Moodle 5.3 LTS and 5.2 need PHP 8.3 and also support 8.4. Moodle 5.1 runs on 8.2 to 8.4, and Moodle 4.5 LTS on 8.1 to 8.3. Every supported Moodle release can run a PHP build fixed for PHP2Shell, but PHP 8.5 is still development-only for Moodle, so production sites should use 8.3 or 8.4.
Last reviewed against Moodle's PHP policy, Moodle's release notes and php.net.
Requirements table
Moodle releases and the PHP versions they support
Moodle sets a minimum PHP version for each release and adds newer PHP branches as it tests them. Long-term support (LTS) releases keep security fixes for about three years.
| Moodle release | Released | General support | Security support until | PHP | PHP2Shell-fixed releases it can run |
|---|---|---|---|---|---|
| Moodle 5.3 (LTS) | 5 October 2026 | 4 October 2027 | 1 October 2029 | 8.3 to 8.4 | 8.3.36 or 8.4.27 |
| Moodle 5.2 | 20 April 2026 | 19 April 2027 | 4 October 2027 | 8.3 to 8.4 | 8.3.36 or 8.4.27 |
| Moodle 5.1 | 6 October 2025 | Ended 5 October 2026 | 19 April 2027 | 8.2 to 8.4 | 8.2.35, 8.3.36 or 8.4.27 |
| Moodle 4.5 (LTS) | 7 October 2024 | Ended 6 October 2025 | 4 October 2027 | 8.1 to 8.3 | 8.2.35 or 8.3.36 |
| Moodle 5.0 | 14 April 2025 | Ended 20 April 2026 | Ended 5 October 2026 | 8.2 to 8.4 | 8.2.35 to 8.4.27, but Moodle 5.0 itself is unsupported |
| Moodle 4.4 | 22 April 2024 | Ended 21 April 2025 | Ended 8 December 2025 | 8.1 to 8.3 | 8.2.35 or 8.3.36, but Moodle 4.4 itself is unsupported |
A distribution's PHP package can carry the fix under an older version number, so judge a distribution build by its vendor's advisory: how to read a backported version. PHP's own branch dates are on PHP end of life dates, and the PHP version requirements hub covers other platforms.
Sources: Moodle PHP policy; Moodle releases; Moodle 5.3 release notes
Education sites
What PHP2Shell means for UK schools, colleges and universities
A Moodle site holds learner accounts, coursework, grades and messages, and it is built to accept logins and file uploads from learners over the internet. PHP2Shell can let an attacker with no login run code on the server beneath it. The NCSC's alert says organisations using any version of PHP are affected, and CISA added both CVEs to its Known Exploited Vulnerabilities catalogue on 26 October 2026.
Moodle HQ acted on its own sites: its 22 October 2026 news post says it took its public-facing sites offline as a precaution while it patched, and it urged self-hosted administrators to tell whoever updates PHP for them and to plan the update immediately. If a PHP update cannot happen soon on your site, read whether to take it offline in the meantime, and the PHP2Shell reference page for the interim settings.
PHP 8.5 is not a Moodle option yet
Moodle's PHP policy, last updated on 15 September 2026, says support for PHP 8.5 is being built for Moodle 5.3 but is incomplete and meant for development only. So the PHP2Shell choice for a live Moodle site is 8.3.36 or 8.4.27, depending on what your Moodle release accepts.
Planning tip for term time: patching within your current PHP branch needs no Moodle upgrade when your release already supports that branch, so it can go in quickly. Save branch moves and Moodle upgrades for a planned window away from assessment deadlines.
Source: Moodle HQ news, 22 October 2026
Your route
The PHP move for each Moodle release
On Moodle 5.3 LTS or 5.2
Both need PHP 8.3 at least, so the site is already on a branch with a fixed release. Install 8.3.36, or 8.4.27 if you run 8.4. Moodle 5.3 is the release to settle on: its security support runs to 1 October 2029.
On Moodle 4.5 LTS
The only supported release that still accepts PHP 8.1, which has no PHP2Shell release from the PHP project. Move to 8.3.36 within Moodle 4.5, with no Moodle upgrade needed. That same PHP branch then carries you to 5.3 when you upgrade.
On Moodle 5.1 or 5.0
Moodle 5.1 keeps security fixes until 19 April 2027 and runs on 8.2 to 8.4. Moodle 5.0's security support ended on 5 October 2026, so a 5.0 site should patch PHP now and upgrade Moodle next. Choose 8.3 or 8.4 over 8.2, which reaches end of life on 31 December 2026.
Cron and the command line
Moodle runs its scheduled tasks through a cron job that calls the command-line PHP every minute. Moodle's own documentation warns that this PHP is a different program from the one serving the site and is not always the same version, so it needs its own check after any PHP change.
The environment check
Let Moodle test the server before you change it
Moodle's Environment page, under Site administration, then Server, compares your database, PHP version and PHP extensions with the requirements of a chosen Moodle release.
Using it well
- Choose a later Moodle release from its version list to see that release's requirements against your current server, before you upgrade anything.
- Press "Update component" first. It downloads the latest requirements data from download.moodle.org, so a check made today reflects Moodle's current rules.
- Every problem reported as an error must be fixed before Moodle will install that release; items marked as recommendations are worth fixing too.
- The PHP info page, also under Site administration, then Server, shows the full phpinfo output for the PHP serving the site.
What Moodle 5.3 asks of PHP
- PHP 8.3.0 or later; 8.4 is supported too.
- 64-bit PHP only.
- The
sodiumextension. max_input_varsof 5000 or more. Check it again after a branch change, because a new PHP build may read a different php.ini;php --inishows which file the command line loads.
Plugins have their own compatibility. Moodle's upgrade guide asks you to find plugin versions for your target release in the Moodle Plugins directory before you upgrade, and the same check is sensible before a PHP branch change.
Sources: Moodle Environment; Moodle 5.3 requirements; Moodle environment page source
Upgrade steps
Changing PHP on a Moodle server
Run the command-line scripts as your web server user: Moodle's
examples use apache, and the user may
be www-data or
httpd on your system. Installing PHP
itself is covered in
how to update PHP.
- Run the environment check. Update the component, then check your current release and, if you plan to upgrade, the target release.
- Check your plugins. Confirm each third-party plugin has a version for your Moodle release that works on the PHP branch you are moving to.
- Back up three things. The Moodle code, the moodledata folder and the database.
- Rehearse on a copy of the site. Moodle recommends testing upgrades on a copy of production; a PHP branch change deserves the same.
- Switch the live server in maintenance mode.
Enable maintenance mode, let any running cron job finish, change
PHP, restart PHP-FPM or Apache, purge caches and switch maintenance
mode off:
cd /path/to/moodle sudo -u www-data /usr/bin/php admin/cli/maintenance.php --enable # ... install the fixed PHP, then restart PHP-FPM or Apache ... sudo -u www-data /usr/bin/php admin/cli/purge_caches.php sudo -u www-data /usr/bin/php admin/cli/maintenance.php --disable - Point cron at the new PHP.
Moodle's recommended cron entry names the PHP binary, so after a
branch change make sure it runs the new one:
* * * * * /usr/bin/php /path/to/moodle/admin/cli/cron.php - Check the result. Use the checks in the next section.
Upgrading Moodle to 5.3 as well?
Moodle 5.3 upgrades from 4.4 or later. Moodle now keeps its
web-facing files in a public folder,
and sites coming from 5.0 or older must point the web server's
document root at it; config.php
stays in the Moodle root, not in public.
Never copy new code over old: move the old code aside and copy
plugins into the matching places in the new tree. The upgrade runs
from Site administration, then Notifications, or from
admin/cli/upgrade.php, which does
not turn on maintenance mode or take a backup for you.
Sources: Upgrading Moodle 5.3; Administration via command line; Moodle cron
Confirm it worked
Checking Moodle is on the fixed PHP
- The Environment page is clean. For your current release, every check passes and Moodle reports that the server meets all minimum requirements.
- PHP info shows the right build. The version is 8.3.36, 8.4.27 or later on its branch, or a distribution package your vendor lists as fixed.
- Cron runs on the same version. Run the cron command once by hand, as Moodle's documentation suggests, and check
/usr/bin/php -v(or whichever binary your cron entry names) against the PHP info page. - Learners can work. Log in as a test student, open a course, submit a file and post to a forum, so the parts of Moodle people use daily are proven on the new PHP.
- The exposure window is reviewed. If the site was reachable on a vulnerable build, go through the compromise checks; patching does not remove anything an attacker may have left.
Running other PHP services for staff and students? The Nextcloud and Drupal pages cover their own PHP ranges, and how to check your PHP version explains the version checks in more detail.
Moodle questions
Moodle PHP version FAQs
What PHP version does Moodle 4.5 need?
Moodle 4.5 LTS runs on PHP 8.1, 8.2 and 8.3. PHP 8.1 has no PHP2Shell release from the PHP project, so a 4.5 site on 8.1 should move to 8.3.36 now. That keeps Moodle 4.5, which has security support until 4 October 2027, and gives a PHP version Moodle 5.3 also accepts.
Can Moodle run on PHP 8.5?
Not for a live site yet. Moodle's PHP policy describes PHP 8.5 support as still being implemented for Moodle 5.3, incomplete and for development use only. The newest fixed PHP release for a production Moodle site is 8.4.27.
What PHP does Moodle 5.3 need?
PHP 8.3.0 or later, with 8.4 also supported, and 64-bit PHP only. The 5.3 release notes also require the sodium extension and a max_input_vars setting of at least 5000. Sites can upgrade to 5.3 from Moodle 4.4 or later.
Our Moodle is hosted for us. What should we ask?
Ask which PHP build serves your site, whether it includes the PHP project's 21 October 2026 fixes or a vendor backport of them, and when it was applied. Moodle HQ's own news post on 22 October 2026 urged self-hosted administrators to alert whoever updates PHP for their sites, so make sure that person or provider has the message.
Do we need to upgrade Moodle to fix PHP2Shell?
No. PHP2Shell is in PHP, so the fix is a patched PHP build, and every supported Moodle release can run one. A Moodle upgrade is still worth planning if you are on 5.0 or 4.4, whose security support has ended.
Know your exposure
Find every PHP server you run
Patching the server you know about is the easy part. A vulnerability scan finds the forgotten staging site, the old microsite and the appliance with PHP inside, then tells you which ones are still exposed.