Outdated PHP Version: Why Hackers Target It and How to Fix It

Almost every website runs on PHP. PHP comes in versions, and each version stops being looked after on a fixed date. Once a version reaches that date, it gets no more security fixes. Right now, many live websites are still on versions that have already passed that date or are about to. PHP 8.1 stopped getting fixes at the end of 2025. PHP 8.2 stops on 31 December 2026. This is a simple guide to what that means for your website, how to check which version you are on, and what a safe update really involves.

What PHP is, and why its version matters

PHP is the language most websites are built on. WordPress, WooCommerce, Magento, Joomla and Laravel all run on it, which covers most business websites. You never see PHP as a visitor. It is the engine working behind the pages, the forms and the logins.

Like any software, PHP comes in versions, and each version is looked after for a set time. During that time, the team behind PHP puts out fixes, including security fixes for weak points found along the way. When a version reaches its end of life, those fixes stop. From that day, any new weak point found in that version stays open, because nobody is fixing it any more. That is the whole reason the version your site runs on matters, and why an old one is a problem, not just an old number.

Where each PHP version stands in 2026

The table below shows where the recent versions stand, taken from the official PHP supported-versions page. If your site is on anything in the top two rows, it is on borrowed time or past it.

Why old PHP gets attacked, and why it is not personal

Here is the part most people miss. The attacks on old PHP are not aimed at you by name. They are automatic. Bots crawl the whole web, day and night, looking for any site running a version with a known hole. Your site does not have to be a target. It only has to be found.

This is what makes an old version so risky. When a PHP version reaches its end of life, the weak points found after that are written up in public, but never fixed. So the version turns into a list of open doors that anyone can look up, and the bots simply try every door on every site they reach. Websites on old PHP are a well-worn way in for the kind of attack listed in the OWASP Top Ten. The risk then sits on your site and on the customer data it holds, which is what turns a technical detail into a business one.

Security is not the only thing that gets worse, though. The problems tend to come together, and they get worse the longer a site stays on an old version.

• Plugin and theme updates start to fail: new versions stop supporting old PHP, so the updates you rely on either refuse to install or break the site when they do.
• Hosts push the change: they are dropping old PHP from their servers, and some move a site to a newer version with little notice, which can take it down.
• The site runs slower: newer PHP versions are faster, so an old one leaves speed on the table, and that also affects your search ranking.
• It gets harder to explain: a client form, an insurer or an auditor will not be happy to see customer data running on old, unfixed software.

How to check which PHP version your site runs

You do not need a developer to find this out. There are three easy ways, and any one of them will tell you.

The most reliable is your hosting control panel. Most panels show the PHP version under a section called something like PHP, Software or Site Settings, often with a drop-down to change it. On WordPress, go to Tools, then Site Health, then the Info tab, and look under Server. The active PHP version is listed there. If you would rather not log in to anything, a web developer or IT provider can read the version from the outside in a moment.

Why you cannot just flip the switch

Because changing the PHP version is a drop-down in most hosting panels, it is easy to think the whole job takes ten seconds. The change does. What happens next is the catch.

A newer version of PHP drops some old code and ways of working. So a theme, a plugin, or custom code written for PHP 7 or 8.0 can suddenly throw errors or stop the page from loading the moment the version moves up. On a simple site, nothing may break. On an older or custom-built one, the home page can go blank. There is no safe way to know which it will be without testing, and that is exactly why changing it and hoping is how sites go down.

What a safe update looks like

A careful update follows the same shape every time, and it keeps the live site up the whole way through.

First, a full backup of the site and the database, so there is always a safe point to go back to. Then the version is moved up in a careful way, and every place the update breaks is found: old code in themes, plugins and any custom files. Those are fixed or replaced. Last, the whole site is tested, the pages, the forms, the checkout, the logins and anything that talks to another system, before it goes back to normal. Done this way, visitors never see a thing. For a custom-built site, the fixes can go deeper, which is where web development work meets the update, and the security check that runs alongside it follows the same way we handle our cybersecurity service.

What it costs, and how to get it done

Updating PHP is not an expensive job for most sites, and it is far cheaper than fixing a hacked or broken one. Listonics does it as a fixed-price service, from AED 700 to AED 1,500, set by the size of the site, with the fix work included, so there is no surprise bill if the update breaks something. A simple WordPress site is at the lower end. A shop or a custom build is higher.

If you are not sure which version you are on or what would break, that is the normal place to start, and the check is free. You can read the full service on our PHP version update page, or send us your website address and an engineer will check the version and come back with a fixed price before any work.

Frequently asked questions

Written by Srinivasan Ramachandran, Founder, Listonics · Published Oct 23, 2026 · Last reviewed October 24, 2026 · 1628 words