PHP 8.1 Is End of Life. Here Is How to Check and Upgrade Safely

PHP 8.1 reached its official end of life on December 31, 2025. That means no more security patches, ever, for that version. Several managed hosts forced upgrades on their customers in January 2026, and some of those upgrades broke live sites. If you run your own VPS, nobody is going to force your upgrade for you. So the risk just sits there quietly until something goes wrong.

Let me walk you through how to check what you are actually running, why this matters more than it might seem, and how to upgrade without breaking your site.

What end of life actually means

The PHP project gives every version two years of active support, then two more years of security-only support. After that window closes, the version is done. Not slow. Not reduced. Done. According to PHP.Watch, PHP 8.1 will not receive any further security or bug fixes from the PHP team. If someone finds a new vulnerability in PHP 8.1 next month, it stays open forever on that version. Nobody is coming to fix it.

This matters more than most other software going stale, because attackers actively look for it. They scan server headers and response fingerprints to find sites still running end of life PHP, then check those sites for known unpatched issues. Running an old PHP version does not just mean missing new features. It means standing in a spot attackers already know how to search for.

Check what you are actually running first

Before anything else, find out your real number. On a VPS, SSH in and run:

php -v

If you run WordPress, go to your admin dashboard, then Tools, then Site Health. It shows your PHP version right there, along with a warning if it is out of date. For a Laravel app, check the "php" line inside your composer.json file, since that tells you the minimum version your code expects, though it does not always match what the server is actually running.

Do not skip this step. I have seen enough forum threads where someone assumed they were fine because they set up the server two years ago, only to find out their host quietly changed the default PHP version at some point.

Why so many sites are still exposed

This is not a small, edge case problem. One report from 365i puts the number of top-traffic PHP sites still running an end of life PHP version at roughly 55 percent as of April 2026. I want to be honest that this is one source's tally, not an official industry-wide count, but it lines up with what I would expect. Upgrading PHP is genuinely scary for a lot of small site owners, because it can break plugins, themes, or old custom code that nobody has touched in years. So people put it off. That hesitation is understandable. It is also exactly why attackers keep finding easy targets.

How to upgrade without breaking your site

Here is the order I would follow, and I think it matters more than which exact PHP version you land on.

1. Pick your target version first. PHP 8.3 or PHP 8.4 are solid, well-supported choices right now. I would avoid jumping straight to the newest release the same week you do this upgrade, since plugins and packages take time to catch up on brand new versions. A one or two version jump is usually smoother than the very latest.
2. Install the new version alongside the old one. On Ubuntu, the Ondrej Sury PPA lets you install multiple PHP versions side by side, so PHP 8.1 keeps running while you set up 8.3 or 8.4 in parallel. Nothing switches over until you tell it to.
3. Test on a staging copy first. Clone your site or app to a staging URL, point that copy at the new PHP version, and click through the actual features you rely on. For WordPress, check your most-used plugins one at a time. For Laravel, run your test suite if you have one, and watch for deprecation warnings in your logs.
4. Switch the live PHP-FPM pool over. Once staging looks clean, update your Nginx or Apache config to point at the new PHP-FPM socket, then restart the web server. Keep the old PHP version installed for a few days as a fallback, just in case.

The catch: your plugins and packages might not be ready

This is the real reason people delay this upgrade, and I do not think it is an unreasonable worry. Old WordPress plugins, especially ones nobody has updated in a year or two, sometimes break on newer PHP versions because of deprecated functions or removed features. Laravel apps can hit the same wall with outdated Composer packages.

The fix is not to skip the upgrade. It is to test properly first, on staging, before touching your live site. If a specific plugin breaks, that is useful information. It tells you that plugin is unmaintained and worth replacing anyway, since an unmaintained plugin on an old PHP version is its own security risk sitting right next to the PHP one.

FAQ

Is PHP 8.1 still usable if I just do not touch the server?
It will keep running, yes. But any new vulnerability found in it from this point forward has no fix coming. That risk grows the longer you wait, not the other way around.

What if my hosting provider says they patch PHP 8.1 themselves?
Some Linux distributions, like Ubuntu, do backport certain security fixes to older PHP packages in their own repositories for a while. That is not the same as full PHP project support, and it does not cover everything. I would not treat it as a long-term plan.

Should I go straight to PHP 8.5 since it is the newest?
You can, but I would check plugin and package compatibility carefully first, since the newest release has had the least time for the ecosystem to catch up. PHP 8.3 or 8.4 is a safer landing spot for most existing sites right now.

How do I know if my WordPress plugins support the new PHP version?
Check each plugin's page on WordPress.org, which usually lists a "Requires PHP" and "Tested up to PHP" line. If a plugin has not been updated in over a year, treat that as a warning sign on its own.

Can I skip staging and just upgrade live if my site is small?
You can, but I would not recommend it. Even a small site takes real time to fix if the checkout page or contact form quietly breaks and you find out from a customer instead of from your own testing.

Bottom line

PHP 8.1 is done. No more patches, ever. If you are not sure what you are running, check it today, since that step takes two minutes. Then plan a real upgrade with staging first, not a live-site gamble. The plugins or packages that break during testing are usually the ones you needed to replace anyway.

Sources: PHP.Watch, PHP 8.1 reached its End-of-Life; HeroDevs, PHP End-of-Life Dates 2026; 365i, PHP 8.1 End of Life: What Happened Next. Verified against official PHP release documentation on August 29, 2026.