Column 1
Skip to content

PHP 8.5.9, 8.4.24, 8.3.33, and 8.2.33: Hosting Patch Checklist

August 3, 2026

On July 30, 2026, PHP announced versions 8.5.9, 8.4.24, 8.3.33, and 8.2.33 as security releases. Treat this as current runtime maintenance for hosting servers, WordPress, WooCommerce, and custom PHP applications. The official announcements ask users of each branch to upgrade; they do not enumerate public issue details, so this guide stays focused on safe maintenance and verification.

Confirm which PHP runtime each application uses

Start with an inventory of the production PHP version selected for every site, worker, scheduled task, and application pool. Record the application owner, maintenance window, package source, and whether the runtime is managed by the host, control panel, operating system, or application platform.

  • Review WordPress and WooCommerce sites alongside custom PHP applications and background workers.
  • Check the package maintainer or hosting provider status where PHP is supplied through a distribution or managed platform. Those packages can include backported security fixes, so a source-version comparison alone may not represent the deployed security status.
  • Use the PHP supported versions policy to plan branch lifecycle work while confirming the current package state with the responsible vendor.

Plan the maintenance window

Use the established change-control process for the affected account or server: identify a low-impact window, confirm the existing restore path, and coordinate the maintenance notice with the site owner. This routine update review does not require creating a new full-account backup or changing any existing backup schedule.

For cPanel and WHM environments, review the EasyApache PHP update checklist before changing a shared runtime. Administrators responsible for several accounts should also keep the post-update cPanel security checklist nearby for the closeout review.

Apply the approved PHP release

Move each eligible runtime to its provider-approved release path: PHP 8.5.9, 8.4.24, 8.3.33, or 8.2.33, as applicable. Make one controlled change at a time on shared hosting or high-traffic systems, and keep a record of the package source, completion time, and any compatibility observation.

Sites using a hosting panel or application selector should follow the provider’s documented update workflow. A change that is safe for one account can still affect extensions, caching, image processing, payment services, or older custom code in another account.

Validate WordPress, WooCommerce, and PHP applications

After the runtime change, perform a short, user-facing validation pass. Confirm that the homepage, an authenticated WordPress page, forms, scheduled work, and any checkout or account journey that applies to the site respond normally. Review the application and platform health indicators for new compatibility warnings before closing the maintenance window.

For broader site-owner guidance, link the handoff to Fix I.T. Phill WordPress support. Hosting teams maintaining cPanel accounts can also compare their PHP and web-stack review with the cPanel EasyApache security-update workflow.

Document the result and follow up

Close the change with the runtime version, provider confirmation, affected applications, validation results, and any deferred compatibility work. Escalate unresolved warnings through the normal support channel instead of leaving a site on an unreviewed runtime. Continue to watch PHP and platform vendor notices for follow-on guidance.

Official sources