PrestaShop and PHP
PrestaShop PHP version compatibility: 1.7, 8 and 9
PrestaShop 9.1 and 9.2 run on PHP 8.1 to 8.5, and 9.0 on 8.1 to 8.4. PrestaShop 8.0 to 8.2 stop at PHP 8.1, and no 1.7 release goes beyond 7.4. Only PrestaShop 9 can therefore run a PHP branch that received the 21 October 2026 PHP2Shell fixes from the PHP project.
Last reviewed against PrestaShop's developer documentation, PrestaShop's release notes and php.net.
Compatibility table
PrestaShop PHP compatibility, version by version
The fourth column is the one that matters for PHP2Shell: the branches a PrestaShop release supports that also received a fixed release from the PHP project on 21 October 2026.
| PrestaShop | PHP supported | PrestaShop recommends | Fixed PHP branches it can run | Newest release |
|---|---|---|---|---|
| 9.2 | 8.1 to 8.5 | Not yet in the devdocs table | 8.2 to 8.5 | 9.2.0, 30 September 2026 |
| 9.1 | 8.1 to 8.5 | 8.5 | 8.2 to 8.5 | 9.1.5, 18 August 2026 |
| 9.0 | 8.1 to 8.4 | 8.4 | 8.2 to 8.4 | 9.0.3, 3 February 2026 |
| 8.0 to 8.2 | 7.2 to 8.1 | 8.1 | None | 8.2.8, 18 August 2026 |
| 1.7.8 | 7.1 to 7.4 | 7.4 | None | Not covered here |
| 1.7.7 | 7.1 to 7.3 | 7.3 | None | Not covered here |
| 1.7.5 and 1.7.6 | 5.6 to 7.2 | 7.2 | None | Not covered here |
| 1.7.4 | 5.6 to 7.1 | 7.1 | None | Not covered here |
| 1.7.0 to 1.7.3 | 5.4 to 7.1 | 7.1 | None | Not covered here |
| 1.6.1.x | 5.2 to 7.1 | 7.1 | None | Not covered here |
The fixed releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. 8.2.35 closes PHP2Shell, yet the 8.2 branch itself loses support at the end of 2026, so on PrestaShop 9 aim for 8.3 or later. PrestaShop's developer documentation had no 9.2 row on the review date; the 9.2 range comes from the 9.2.0 release announcement.
Sources: system requirements for 9, for 8 and for 1.7; PrestaShop 9.2.0; PrestaShop releases. For other platforms, see the PHP version requirements hub.
The PrestaShop 8 problem
No fixed upstream branch for PrestaShop 8
PrestaShop 8 still gets new releases, the latest being 8.2.8 on 18 August 2026, yet its PHP ceiling has not moved. Every branch it supports, 7.2 to 8.1, is past end of life, and none of them received a fixed release from the PHP project.
That does not mean an 8.1 shop has to be unprotected. php.net's advice for 8.1 and older is to ask whoever supplies your PHP, because backported fixes exist from some distributions and long-term support vendors. Ubuntu's 22.04 php8.1 package, version 8.1.2-1ubuntu2.28, is one that carries them. It does mean the protection depends on your supplier, not on the PHP project.
Distribution packages with the fixWhat PrestaShop itself said
PrestaShop's notice on the October 2026 PHP releases, published on 21 October, made four points worth keeping in front of you:
- The flaws are in PHP. PrestaShop and its modules are not the problem, and no PrestaShop patch will fix it.
- 1.7 and 8.x shops mostly run PHP 7.x or 8.1. PrestaShop's description of its own installed base.
- A patched PHP build comes first. Getting one for the version you run now is the immediate priority.
- The PrestaShop 9 upgrade is separate. PrestaShop calls it a longer-term job, not an emergency fix, and advises against rushing a major upgrade because of these flaws.
PrestaShop 1.7 is in a tighter spot
A 1.7.8 shop can run PHP 7.4, the oldest branch with a source-only backport from the PHP project. Shops on 1.7.7 or earlier top out at 7.3 or below, where the PHP project published nothing, so a supplier's backport or a PrestaShop upgrade are the only routes.
What an 8.x or 1.7 shop can do
Four options, and most shops need two of them
The first two protect the shop on the PHP it has now; the third ends the problem; the fourth covers the time before either is in place.
A fixed package for the PHP you have now
Ask your host, or the distribution your server uses, whether its PHP 8.1 or 7.x package carries the PHP2Shell fixes as a backport. PrestaShop's own advice is to get that confirmation in writing. This keeps the shop on the PHP its PrestaShop release supports.
Compile PHP from the source-only backport
If you compile your own PHP, there are minimal backports for 7.4, 8.0 and 8.1 from the PHP security team, published as source code. They come with no packaged release or new version number, and nothing exists for 7.3 or earlier.
Move the shop to PrestaShop 9
The lasting fix. PrestaShop 9.0 accepts PHP 8.2 to 8.4 among its supported branches, and 9.1 and 9.2 accept 8.2 to 8.5, every one of which got a fixed release on 21 October 2026.
Restrict or close the shop while you wait
If no fixed build is in place yet, remember that CISA advises taking PHP systems that run 8.1 or older offline. The NCSC's priority list ends in the same place for systems that cannot be updated or mitigated quickly enough.
More on the backports and their limits: PHP end of life. The decision about closing the shop: should I take my website offline?
Upgrade route
PHP 8.1 is the bridge from PrestaShop 8 to 9
Put the two compatibility charts side by side and only one PHP branch appears in both: 8.1. PrestaShop's Update Assistant module also bases the versions it offers on the PHP the server runs. So the upgrade happens on 8.1, and the move to a newer branch comes straight after it.
-
Step 1
Get onto a patched PHP 8.1
If the shop runs PHP 7.x on PrestaShop 8, move it to an 8.1 build that carries the backported fixes. This protects the shop now and sets up the bridge.
-
Step 2
Back up and copy the shop
Take a full backup of files and database, then build a staging copy on the same PHP. PrestaShop's update guide urges a backup before any update and suggests keeping a manual one alongside the module's own.
-
Step 3
Check modules and the theme
Ask each module and theme developer whether they support PrestaShop 9. The Update Assistant deactivates non-native modules by default during the update, because they may destabilise the new version.
-
Step 4
Run the Update Assistant on the copy
The module moves through version choice, update options, backup, the update itself and a post-update checklist. PrestaShop says version 7.6.6 of the module fully supports 9.2.
-
Step 5
Move the copy off 8.1
Once PrestaShop 9 works on the copy, switch its PHP to 8.3, 8.4 or 8.5 at the fixed release, within the range your 9.x release supports. Test checkout, payment modules and order emails again.
-
Step 6
Repeat on the live shop
Same order, at a quiet trading time, with the backup from that morning to hand: patched 8.1, PrestaShop 9, then the newer PHP branch.
Coming from 1.7? The same logic applies one step earlier. 1.7.8 and PrestaShop 8 share PHP 7.2 to 7.4, so a 1.7.8 shop moves to 8.x on one of those, then on to 8.1 and PrestaShop 9. Releases that stop at 7.1, 1.7.4 and earlier, share no branch with PrestaShop 8 and reach 1.7.8 first. The Update Assistant's documentation says its latest versions work with every release from 1.7 up; a 1.6 shop has to go through 1.7 first.
Sources: PrestaShop, update from the Back Office; Update Assistant module. The server side of each PHP change is on how to update PHP.
Extensions and settings
What the new PHP needs before PrestaShop will run
A new PHP branch is a fresh install with its own extensions and its own configuration file. Set these up before the switch, not after the shop shows an error.
Extensions
PrestaShop 8 and 9 list the same set: cURL, DOM, Fileinfo, GD,
Iconv, Intl, JSON, Mbstring, OpenSSL, PDO with the MySQL driver,
SimpleXML and Zip. Run php -m under
both branches and compare the lists.
Memory and settings
PrestaShop 9 recommends a memory_limit
of at least 512M, double the 256M suggested for PrestaShop 8,
and both need allow_url_fopen switched
on. php --ini shows which file the new
branch reads.
Database and web server
Both versions ask for MySQL 5.7 or MariaDB 10.2 at least, with a recent version recommended, and Apache 2.4 or later. Composer is needed only for development versions of PrestaShop 9.
Interim settings on a shop
Tuning the stopgaps so the shop keeps trading
The PHP project's interim settings reduce the risk without removing it. PrestaShop's notice adds shop-specific cautions for anyone applying them, and suggests testing each one on staging first.
- Request size limits. Lowering
post_max_sizeandupload_max_filesizehelps, but leave enough headroom for product images, imports and other uploads the shop relies on. - Upload progress. Set
session.upload_progress.enabled=0, then restart the PHP workers so the change takes hold. - Unlimited memory. PrestaShop warns that
memory_limit=-1is risky unless something outside PHP enforces a memory cap. - A web application firewall. Useful as an extra layer, provided the origin server accepts traffic only from the firewall provider. It does not replace the PHP update.
The full list, with the PHP project's own wording on what each setting does, is in PHP2Shell explained.
Confirm it worked
Read it from the Back Office, then double-check
In the Back Office, open Advanced Parameters, then Information. The page sums up the shop's configuration: the PrestaShop version, server details, the PHP version and the MySQL version.
The same page lists files that differ from the original installation. Modules and theme changes appear there normally, but a file you cannot account for is worth a closer look.
- Compare the number. The PHP version should be no lower than the fixed release on its branch, or be a supplier's package that your host confirms in writing carries the backport.
- Make sure it is loaded. PrestaShop's notice is blunt that an update which is installed but not loaded protects nothing: restart every PHP process, and rebuild container images if the shop runs in Docker. How to confirm.
- Check from outside the shop. More ways to read the version: check your PHP version.
- Look back as well as forward. If the shop ran unfixed PHP on the internet, check it for signs of intrusion: have I been compromised?
Source: PrestaShop user guide, Information. Running a different shop? See Magento 2, Magento 1 and OpenMage, WooCommerce.
Quick answers
PrestaShop PHP version questions
What PHP version does PrestaShop 8 need?
The whole PrestaShop 8 line, 8.0 through 8.2, accepts PHP 7.2 up to 8.1, and 8.1 is the version PrestaShop recommends. Its documentation marks PHP 8.2 and later as not supported, and that still applies to 8.2.8, the newest 8.x release, from 18 August 2026.
Can I run PrestaShop 8 on PHP 8.2 or 8.3?
Not as a supported setup. PrestaShop's compatibility chart for 8.0 to 8.2 stops at 8.1. To run 8.2 or a newer branch, the shop needs PrestaShop 9. Until then, the safe option is a PHP 8.1 build with the PHP2Shell fixes backported.
What PHP version is best for PrestaShop 9?
PrestaShop recommends PHP 8.5 for 9.1 and PHP 8.4 for 9.0, which does not support 8.5. The 9.2 release notes list PHP 8.1 as the minimum and support up to 8.5. Whichever branch you choose, use its fixed release or later: 8.5.12, 8.4.27 or 8.3.36.
Does updating PrestaShop fix PHP2Shell?
No. PrestaShop's notice on the October 2026 PHP releases says the flaws are in the PHP runtime, not in PrestaShop or its modules, and that there is no PrestaShop patch to install. The fix is a PHP build that includes it.
Which PHP version does PrestaShop 1.7 support?
It varies by minor version. 1.7.8 supports PHP 7.1 to 7.4, 1.7.7 supports 7.1 to 7.3, and earlier 1.7 releases stop at 7.1 or 7.2. None of those branches received a PHP2Shell release from the PHP project.
Is PHP 8.1 safe for a PrestaShop 8 shop?
Only in a build that carries the backported fixes. The PHP project released none for 8.1, which reached end of life on 31 December 2025, so an unpatched 8.1 is exposed. Ask your host or distribution for written confirmation that your 8.1 package includes them.
Know your exposure
Find every PHP server you run
Patching the server you know about is the easy part. A vulnerability scan finds the forgotten staging site, the old microsite and the appliance with PHP inside, then tells you which ones are still exposed.