When people talk about keeping a Drupal site secure, the conversation almost always focuses on Drupal itself — applying security updates, staying on a supported version, watching for advisories about contrib modules (the add-ons and extra features that extend what Drupal can do). That's all correct and important.
There's a layer underneath Drupal that receives much less attention: PHP. PHP — Hypertext Preprocessor — is the programming language that Drupal is built on. Your Drupal site doesn't run directly on the server. It runs on PHP, which runs on the server. When your PHP version reaches end of life — meaning it no longer receives security updates — that creates a security gap that no Drupal update can fix.
Most site owners have no idea what PHP version their site is running. This is worth checking.
Two layers, two separate update cycles
Think of it like this: Drupal sits on top of PHP the way a building sits on a foundation. You can renovate the building as much as you like, but if the foundation has problems, the renovation doesn't help.
Drupal security updates fix vulnerabilities in Drupal. They do not fix vulnerabilities in PHP. The two are maintained by entirely separate teams, on separate release schedules, with separate security advisories.
A site that is fully up to date on Drupal security patches but running on an end-of-life PHP version has a real security gap — one that most standard maintenance conversations won't catch, because PHP is a server-level concern rather than a site-level one.
PHP version status
PHP releases follow a predictable pattern: each version receives active support for two years, then security-only fixes for one more year, then nothing. End of life — meaning no more security patches, ever.
| PHP Version | End of active support | End of security fixes | Status |
|---|---|---|---|
| PHP 8.0 | November 2022 | November 2023 | End of life |
| PHP 8.1 | November 2023 | December 2025 | End of life |
| PHP 8.2 | December 2024 | December 2026 | Security fixes only |
| PHP 8.3 | December 2025 | December 2027 | Active support |
| PHP 8.4 | December 2026 | December 2028 | Current |
PHP 8.1 reached end of life in December 2025. If your site is still running on it, PHP vulnerabilities discovered since then are not being patched. PHP 8.2 is currently in security-only maintenance mode, meaning it still receives patches for security issues but no other fixes.
Why this gap often goes unnoticed
The PHP version your site runs on is typically set by your hosting provider or the server your site lives on. Changing it usually requires either asking your host to update it, or doing it at the server level. It's not something you do through the Drupal admin panel.
This means there's a disconnect between who maintains Drupal (often a developer or a service like Nodely) and who controls the PHP version (the hosting provider or whoever manages the server). The security conversation often stops at Drupal, because that's what's visible.
A complete maintenance picture covers both. You want to know that your Drupal version is current, your contrib modules are patched, and your PHP version is supported.
It's also worth knowing that Drupal itself requires a minimum PHP version. Drupal 11 requires PHP 8.3 or higher. If you're running older PHP, you may find you can't update Drupal itself without updating PHP first. The two constraints are linked.
How to find out what PHP version your site uses
There are a few ways to check. If you have access to the server or hosting control panel, the PHP version is usually visible in the settings. Your hosting provider can also tell you. If you have a developer maintaining your site, they can check in a few seconds.
If you'd rather not dig around in hosting panels, we include PHP version as part of the free security check we run for new enquiries. You'll get a clear picture of where things stand — Drupal version, PHP version, and which security advisories currently apply to your site.
What to do if you're on an end-of-life PHP version
The first step is confirming the PHP version. The second is checking whether your current Drupal version and contrib modules are compatible with a newer PHP version — most will be, but it's worth verifying before making a change. The third is coordinating with your hosting provider to update PHP.
PHP upgrades are generally lower-risk than Drupal version upgrades. Compatibility issues within the same major version family (8.x) are rare. But testing before switching is good practice, particularly on older sites that may be running less well-maintained contrib modules.
Nodely handles this as part of the broader maintenance picture. If your site needs a PHP upgrade, we'll identify it, check compatibility, and coordinate it alongside the Drupal maintenance work. Get in touch if you'd like us to take a look.