Twenty-five years of PHP version numbers

Some version numbers you remember for ever. Some only matter until the next ones turn up.

I've been writing PHP for about twenty-five years. In that time I've forgotten most of what I had for lunch, but I can still tell you which version number broke which project.

Version numbers are a strange thing to get attached to. They're just digits with dots in them. But if you've been doing this long enough, each one comes with a memory. Usually a late night. Occasionally a swear word.

PHP 4: Notepad and hope

PHP 4 was where I started. Notepad, an FTP client and a lot of optimism.

There were no frameworks to speak of. There was no Composer. There was a function, mysql_query(), and you stuck whatever you liked inside it. Usually something straight out of $_GET. Nobody told us that was a bad idea. Or if they did, we weren't listening.

The version number didn't matter much back then. You used whatever the host had installed and you were grateful for it.

PHP 5: we got classes (sort of)

PHP 5 gave us proper objects. Then 5.3 gave us namespaces, which meant backslashes in places backslashes had no business being. I hated them for about a month. Now I can't imagine working without them.

PHP 5 also hung around for a very long time. Long enough that "5.2 on the client's server" became a sentence I said far too often. Every developer of a certain age has a 5.2 story. Most of them end with "...so I rewrote it."

The PHP 6 that never was

Then there was PHP 6. Or rather, there wasn't.

It was going to fix Unicode. Books were written about it. Then it was quietly abandoned, and the next version was called 7, just to avoid the confusion. It's the only version number I can think of that's famous for not existing.

There's a lesson in there somewhere about announcing things before they're finished. I've ignored it many times.

PHP 7 and 8: PHP grows up

PHP 7 was the one that shut people up. Same code, roughly twice as fast. I don't think I've ever had an upgrade that made a client happier for doing absolutely nothing.

PHP 8 brought the grown-up stuff. Named arguments, match, enums, readonly properties. Things that make PHP look less like the language people make jokes about, and more like the one quietly running a huge chunk of the web.

And since then there's been a new one every November. Regular as clockwork. 8.2, 8.3, 8.4, 8.5. At some point I stopped getting excited about the release date and started getting nervous about the deprecation list.

The numbers that matter this week

On 21 October, PHP put out an emergency security release for two remote code execution bugs, CVE-2026-109618 and CVE-2026-109619. Somebody gave them a name, PHP2Shell, which is never a good sign. Both are rated 9.2 out of 10. Both go back as far as 2004. So, yes, that's every version in this post, including the ones I'm feeling nostalgic about.

If you run PHP anywhere, these are the most important version numbers in the world right now:

PHP 8.5 → 8.5.12

PHP 8.4 → 8.4.27

PHP 8.3 → 8.3.36

PHP 8.2 → 8.2.35

On 8.1 or older? There's no official release, because those versions are end of life. Some package maintainers have backported the fix without changing the version number, so php -v will tell you nothing useful. Check the package revision, then go and book in that upgrade you've been putting off.

And don't forget the queue workers. A long-running PHP process carries on with the old version until you restart it. F5 won't help you here… 

Here's the thing about important version numbers. They're only important until the next ones.

Two days after the fix, PHP announced another remote code execution bug, CVE-2026-115560, this time in session upload progress. It isn't fixed by the 21 October release. The fix is coming in the next regular release. Until then, the advice is to turn off session.upload_progress.enabled. If you already did that for PHP2Shell, leave it off.

So by the time you read this, the table above is probably already out of date. That's not a failure of the table. That's just how version numbers work.

So, PHP 8.6

PHP 8.6 is due on 19 November. It brings partial function application, a clamp() function, and the usual list of deprecations ahead of PHP 9. I'll test it on the release candidate, wait for Laravel to catch up, and upgrade on a Tuesday. Never a Friday.

In twenty-five years, the version numbers I remember best aren't the ones with the big new features. They're the ones I had to install in a hurry.

Remember the old version numbers fondly.

Patch the new ones today. There'll be another lot along shortly.