Upgrade PHP 8.1 to 8.3 after PHP2ShellPHP vulnerability · PHP2Shell · CVE-2026-109618 / CVE-2026-109619 · PHP RCE · PHP security update

Plan the PHP vulnerability update and migration separately

First confirm whether your current vendor has a PHP2Shell backport. Then test the move from PHP 8.1 to PHP 8.3. A backport for one PHP vulnerability does not restore upstream support to an end-of-life branch.

Do not change major or minor runtime branches directly on production without application and extension testing.

Review the move to PHP 8.2

These compatibility notes summarize the linked PHP migration guide. Review the complete guide for extension-specific changes.

• What changed

  Case conversion in standard string functions becomes ASCII-based rather than locale-sensitive.

  What to search for in your code

  strtolower(), strtoupper() and locale-dependent comparisons.

  Read the PHP 8.2 migration source ↗
• What changed

  str_split() returns an empty array for an empty string.

  What to search for in your code

  Code expecting one empty element from str_split().

  Read the PHP 8.2 migration source ↗
• What changed

  glob() returns an empty array when open_basedir restricts every path.

  What to search for in your code

  Strict false checks on glob() results.

  Read the PHP 8.2 migration source ↗

Review the move to PHP 8.3

These compatibility notes summarize the linked PHP migration guide. Review the complete guide for extension-specific changes.

• What changed

  range() rejects invalid boundary types and invalid step values more strictly.

  What to search for in your code

  range() with objects, arrays, zero or negative steps.

  Read the PHP 8.3 migration source ↗
• What changed

  number_format() handles a negative decimals argument by rounding before the decimal point.

  What to search for in your code

  Negative decimals arguments in number_format().

  Read the PHP 8.3 migration source ↗
• What changed

  Date handling uses more specific exception and error classes.

  What to search for in your code

  DateTime construction and exception handlers.

  Read the PHP 8.3 migration source ↗

Before switching the runtime

• Back up application files, configuration and data, and verify you can restore them.
• Test in staging with the target runtime and the same extensions used in production.
• Review dependency constraints and application, plugin and theme compatibility.
• Exercise login, uploads, mail, scheduled tasks, queues and failure paths.
• Confirm the target package includes the PHP vulnerability fix and remains supported.

Choose your platform update route

Rollback and recovery

Keep known package or image references and a tested restore procedure. Restore configuration and application data consistently if the migration fails. Reverting to a vulnerable runtime reintroduces the PHP vulnerability; review the vendor advisory before exposing that runtime to web traffic.