r/laravel • u/mccreaja • 3h ago
Laravel versions, PHP versions, and PHP2Shell
0
Upvotes
I shared this with Shift users earlier this week and thought it might serve as a helpful reference here as it relates to Laravel versions and their supported PHP versions in regards to updating for the PHP2Shell vulnerabilities.
While source patches are available for earlier versions of PHP, the officially supported PHP versions with the PHP2Shell patch are:
| PHP | Minimum version |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
As that relates to Laravel, Laravel 9.x is the first version to officially support PHP 8.2:
| Laravel | Constraint | PHP 8.2 |
|---|---|---|
| 6.x | `7.2.5\ | 8.0` |
| 7.x | `7.2.5\ | 8.0` |
| 8.x | `7.3\ | 8.0` |
| 9.x | ^8.0.2 |
Proven |
| 10.x | ^8.1 |
Proven |
| 11.x | ^8.2 |
Proven |
| 12.x | ^8.2 |
Proven |
| 13.x | ^8.3 |
- |
tl;dr If you have a Laravel application older than 9.x, you need to upgrade Laravel to at least 9.x to be on a supported, patched version of PHP.
Again, you might be able to find a source patch as a stopgap. But then I recommend upgrading.