Nextcloud PHP version

Nextcloud PHP version requirements, and the order to upgrade in

Nextcloud 35 runs on PHP 8.3, 8.4 and 8.5, and recommends 8.5. Nextcloud 33 and 34 also accept 8.2 but mark it deprecated. All three can run a PHP build fixed for PHP2Shell. Choose 8.4.27 or 8.5.12, because Nextcloud 35's admin overview already warns about PHP 8.3.

Last reviewed against the Nextcloud admin manual, Nextcloud's release schedule and php.net.

Requirements table

PHP support for each released Nextcloud version

Nextcloud publishes a new major release every four months and maintains each for a year, so three majors are usually in support at once. Each adds and deprecates PHP branches on its own schedule.

Nextcloud Released End of life Latest release PHP supported Recommended Overview warns PHP2Shell-fixed releases it can run
Nextcloud 35 (Hub 26 Summer) 16 September 2026 September 2027 35.0.2 (15 October 2026) 8.3, 8.4, 8.5 8.5 Below 8.4 8.4.27 or 8.5.12 (8.3.36 runs, with a warning)
Nextcloud 34 (Hub 26 Spring) 9 June 2026 June 2027 34.0.5 (15 October 2026) 8.2 (deprecated), 8.3, 8.4, 8.5 8.5 Below 8.3 8.3.36, 8.4.27 or 8.5.12
Nextcloud 33 (Hub 26 Winter) 18 February 2026 February 2027 33.0.10 (15 October 2026) 8.2 (deprecated), 8.3, 8.4, 8.5 8.4 Below 8.3 8.3.36, 8.4.27 or 8.5.12
Nextcloud 32 (Hub 25 Autumn) 27 September 2025 Ended September 2026 32.0.15 (10 September 2026), final 8.1 (deprecated), 8.2, 8.3, 8.4 8.3 Release ended 8.2.35 to 8.4.27, but Nextcloud 32 itself gets no more fixes

"Overview warns" is the point below which the PHP version check in the admin overview raises a warning on that release. The next maintenance releases (33.0.11, 34.0.6 and 35.0.3) are scheduled for 12 November 2026. Distribution builds can carry the PHP2Shell fix under an older version number: reading backported versions. For PHP's own branch dates see PHP end of life dates, and for other platforms the PHP version requirements hub.

Sources: Nextcloud 35 requirements; 34; 33; 32; Nextcloud release schedule; PHP version check (35.0.2)

The admin overview

What Nextcloud's own PHP checks tell you

Open Administration settings, then Overview. The "Security & setup warnings" panel at the top runs Nextcloud's setup checks, and several of them are about PHP. The same checks run from the command line with occ setupchecks.

  • PHP version. Reports the running version, and warns when it is below the release's threshold in the table above.
  • PHP memory limit. Flagged as an error below 512MB, the recommended value; Nextcloud warns that some apps and the updater may then misbehave.
  • PHP modules. Lists required modules that are missing and recommended ones, such as intl, sodium and gmp, that are not loaded.
  • PHP OPcache and getenv("PATH"). Both depend on php.ini and PHP-FPM pool settings, so check them again on a new branch, which may read a different configuration.

The overview cannot see PHP2Shell

The PHP version check compares branches, not patch levels. A Nextcloud 35 server on PHP 8.4.24 passes it just as cleanly as one on 8.4.27, yet only 8.4.27 carries the 21 October 2026 fixes. Use the overview to choose a branch, and the exact version or your vendor's advisory to confirm the patch.

Both PHP2Shell CVEs have been on CISA's Known Exploited Vulnerabilities catalogue since 26 October 2026. Read the PHP2Shell reference page for the interim settings, and whether to take a server offline if it cannot be patched soon.

Sources: Nextcloud server source at v35.0.2, setup checks; Nextcloud security and setup warnings

Where PHP runs

Four things to move onto the new PHP

A Nextcloud server runs PHP in more than one way. Miss one and the server ends up split across two PHP builds.

3D cloud server with a shield, for the web server's PHP

The web server's PHP

Nextcloud recommends Apache with PHP-FPM, or nginx with PHP-FPM; Apache with mod_php is also listed. The PHP project rates mod_php as the highest-risk setup for PHP2Shell, so a branch change is a good moment to move to PHP-FPM.

3D server rack, for occ on the command line

occ, the command-line tool

occ runs as the web server user on the command-line PHP. When the web server uses a non-default PHP version, Nextcloud says to run occ with that same version. The command-line PHP also needs apc.enable_cli=1 if you use APCu.

3D magnifying glass with a 24/7 badge, for background jobs

Background jobs

Nextcloud's recommended system cron job calls cron.php every five minutes with a bare php, or through a systemd timer. After a branch change, that bare php may still be the old build.

3D group of users around a secured server, for apps that declare a PHP range

Apps

Each app can declare a minimum and maximum PHP version in its info.xml. Nextcloud checks that at installation, not on later updates, so read the PHP range of each third-party app before moving branch.

Sources: Using the occ command; Background jobs; App metadata

Upgrade order

PHP first, then Nextcloud, one major at a time

Nextcloud cannot skip major releases, and its newest major no longer accepts PHP 8.2. Both rules point the same way: settle PHP on a branch every remaining step accepts, then climb.

A worked example: Nextcloud 33 on PHP 8.2

  1. Move PHP to 8.4.27 or 8.5.12. Nextcloud 33, 34 and 35 all accept both, and this step closes PHP2Shell on its own.
  2. Update to 33.0.10, the latest Nextcloud 33 point release.
  3. Upgrade to 34, using its latest point release, then let cron.php run two or three times.
  4. Upgrade to 35, again to its latest point release.

Rules Nextcloud sets for every major upgrade

  • Take a fresh backup of the database, the data directory and config.php. Downgrading is not supported.
  • Disable third-party apps before the upgrade and enable them again afterwards.
  • Read the critical changes notes for the major you are moving to.
  • Packaged installs, such as Snap, Docker and pre-built virtual machines, follow their own upgrade instructions.

Sources: Nextcloud upgrade guide; Upgrade manually

Upgrade steps

Changing PHP on a Nextcloud server

The commands use www-data, the web server user on Debian and Ubuntu, with Nextcloud in /var/www/nextcloud. Installing the PHP packages is covered in how to update PHP.

  1. Record the starting state. Note what the admin overview shows, then capture the same from the command line: 
    cd /var/www/nextcloud
sudo -E -u www-data php occ status
sudo -E -u www-data php occ setupchecks
  2. Back up. Database, data directory and config.php, even for a patch within the branch.
  3. Install the fixed PHP with matching modules. Install the same modules the old branch had, then set the memory limit, OPcache settings and environment variables in the new build's configuration. Nextcloud recommends at least 512MB of memory per PHP process.
  4. Switch the web server and restart it. Point the site at the new PHP-FPM pool, then restart PHP-FPM and the web server so no process from the old build keeps serving requests.
  5. Move occ and cron to the same branch. If the new branch is not the server's default command-line PHP, call it by name, and do the same in the cron entry: 
    # Web server on a non-default branch? Run occ with that same branch
# (Debian installs each branch as its own binary, such as /usr/bin/php8.4)
sudo -E -u www-data /usr/bin/php8.4 occ setupchecks
    # crontab -u www-data -e
# Nextcloud's documented entry uses a bare php; name the branch instead
*/5 * * * * /usr/bin/php8.4 -f /var/www/nextcloud/cron.php
  6. Run the checks again. Reload the admin overview and rerun occ setupchecks, then fix anything the branch change introduced.
  7. Plan the Nextcloud upgrades. With PHP settled, follow the major-by-major order above.

Confirm it worked

Signs that Nextcloud is fully on the fixed PHP

  • The PHP version check passes in the admin overview and names the fixed release: 8.4.27, 8.5.12 or later on its branch, or a distribution package your vendor lists as fixed.
  • occ agrees with the web server. occ setupchecks reports the same PHP version as the overview.
  • The server is not stuck. occ status shows maintenance mode off and no database upgrade pending.
  • Background jobs still run. The setup checks include background jobs, so a cron entry broken by the PHP change shows up in the same panel.
  • The exposure window is reviewed. A Nextcloud server that faced the internet on a vulnerable build holds people's files and shares; go through the compromise checks as well as patching.

The same split between web and command-line PHP catches out Laravel queue workers and Moodle's cron. For every way of reading a PHP version, see how to check your PHP version.

Nextcloud questions

Nextcloud PHP version FAQs

Which PHP version should I use for Nextcloud 35?

PHP 8.5, which Nextcloud recommends, or 8.4. Both are fixed for PHP2Shell in 8.5.12 and 8.4.27, and neither triggers the PHP version warning in Nextcloud 35's admin overview. PHP 8.3 is still on the supported list, but Nextcloud 35 flags it as deprecated.

Why does my Nextcloud overview say PHP 8.3 is deprecated?

From Nextcloud 35, the PHP version check warns on anything below PHP 8.4. Its message says PHP 8.3 has been deprecated since Nextcloud 35 and that Nextcloud 37 may require at least PHP 8.4. The site still works on 8.3; the warning is notice of what the next majors expect.

Does Nextcloud 35 support PHP 8.2?

No. Nextcloud 35's system requirements list PHP 8.3, 8.4 and 8.5 only. A Nextcloud 33 or 34 server still on PHP 8.2 has to move PHP before it can upgrade to 35, which is a good reason to make the PHP2Shell patch a branch move to 8.4 or 8.5.

Can I upgrade from Nextcloud 33 straight to 35?

No. Nextcloud's upgrade documentation says major releases cannot be skipped. Update to the latest 33 point release, then to 34, then to 35, letting the background jobs run two or three times between majors so pending migrations finish.

Why does occ report a different PHP version from the admin overview?

The overview is produced by the PHP your web server runs, while occ uses the command-line PHP, and the two can be different builds. Nextcloud's occ documentation says that when the web server uses a non-default PHP version, occ should be run with the same version. Point occ and the cron job at the same branch as the web server.

Is Nextcloud 36 out?

Not on 27 October 2026. Nextcloud's release schedule plans it for 17 February 2027. The documentation marked latest already describes 36, so use the manual for the major you actually run when checking PHP requirements.

3D rocket illustration above the call to find every exposed PHP server

Know your exposure

Find every PHP server you run

Patching the server you know about is the easy part. A vulnerability scan finds the forgotten staging site, the old microsite and the appliance with PHP inside, then tells you which ones are still exposed.

Find Every Exposed PHP Server Book a Free Consultation