Why PHP upgrades can't wait
PHP 8.2 is now the oldest PHP branch that still receives security fixes. Code that only runs on PHP 7 or older keeps your server on an unpatched version, and hosts are retiring those versions. In October 2026 the PHP project released fixes for CVE-2026-109618 and CVE-2026-109619, flaws that let attackers run code without logging in, for PHP 8.2 and later only. More in our PHP security alert post.
What we fix
- Removed functions:
create_function(),each(),mysql_*and old constructors. - Deprecations in 8.1 and 8.2: passing null to built-in functions, dynamic properties.
- Stricter types:
TypeErrors inside bundled libraries. - Outdated dependencies: Composer packages and bundled libraries updated to PHP 8-compatible versions.
- CMS sites: ExpressionEngine, WordPress and custom CMSs. For EE, see ExpressionEngine PHP 8 compatibility.
How it works
- 1
Free check
We look at the codebase size, framework and current PHP version.
- 2
Static scan
Automated compatibility checks to find likely problems before running anything.
- 3
Staging on PHP 8
The site or app run on the target version, with every page and feature exercised.
- 4
Fix
Code and dependencies updated, with a list of every change.
- 5
Go live
PHP switched on production, error logs watched afterwards.