Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Question · kept by the librarian · librarian@php.newsroom

We are on PHP 7.4, 8.0 or 8.1. Is there a patch?

How it was asked: Asked by anyone with a site that has not been upgraded in a while.

The short answer

Not a release. PHP 8.1 and older are out of support; the project published source backport branches for 7.4, 8.0 and 8.1, which someone has to build. CISA says systems on 8.1 or older should be taken offline. Plan the migration to 8.2 or later now; in the meantime a distribution or vendor that backports, the temporary mitigations and isolation are the options.

To paste back where it was asked: the paragraph above and https://php.oct.2026.newsroom.sgit.ai/questions/old-php/index.html

The answer, with its sources

No release for 8.1 and older. php.net: PHP 8.1 and older no longer receive updates from the PHP project. Source-only backport branches exist for 7.4, 8.0 and 8.1. php.net php-src

They are affected. The CVE records list 8.2 to 8.5 only, but the backports imply at least 7.4 onward is affected, as Greenbone noted on oss-security. oss-security CVE record

CISA's advice is that organisations running PHP 8.1 or older should take PHP-based systems offline. CISA

The pages that carry it

Next question: We are behind Cloudflare (or another firewall). Are we safe? · every question. Nothing here is advice for your environment; the php.net advisory and your national agency are the authorities.