I have a client whose invoicing app still runs PHP 7.4. I've been asking to upgrade it for two years. The answer is always the same: it works, so leave it. On October 21 that answer got a lot harder to defend, because the PHP2Shell fixes shipped for 8.2 through 8.5, and the old branches live in a murkier place.

Short version for the impatient: if you run PHP 7.4, 8.0 or 8.1, a patched build exists but it carries the same version number as the vulnerable one, so php -v cannot tell you if you're safe. If you run 7.3 or older, no fix exists at all. The rest of this post is how to check, what to do about each case, and why I think "it works" has expired as an argument.

If you're on a supported branch, my PHP 8.5.12 patch checklist is the better starting point. This post is about the PHP end of life problem.

Which branches got what

The fixed versions for supported branches are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Those are the easy ones.

The older branches are where it gets strange.…