This episode of the Jukebox Podcast features Milan Petrović, a WordPress developer with nearly two decades of experience. Milan has built many plugins, especially for bbPress, ran his own Dev4Press business for years, and now works as a full‑stack developer at Freemius. His recent WordCamp Europe talk focused on why running legacy PHP versions in the WordPress ecosystem is increasingly dangerous — and why upgrading to modern PHP matters for both security and performance.
Why PHP versions matter
Most WordPress users notice a PHP version number in their hosting control panel but don’t fully grasp the implications. Milan explains that newer PHP releases do more than add features: they close long-standing security holes and deliver significant performance improvements, including lower memory usage and faster execution. PHP 8 introduced many of those protections and optimizations, and later 8.x versions continue the trend.
The core problem: backward compatibility
WordPress historically prioritized backward compatibility. That policy helped drive massive adoption because sites and hosts could keep working without frequent server upgrades. But it has a downside: the project and the wider ecosystem have lagged behind PHP’s lifecycle. For example, PHP 7.4 reached end of life years ago, yet a substantial share of WordPress sites still run on 7.4 or older.
Milan points out a stark fact: there are thousands of open, confirmed bug reports affecting older PHP branches that will never be fixed in those branches. Any publicly known bug can be turned into an automated exploit. That means sites running unsupported PHP versions are inviting attacks at a platform level — not just at the WordPress or plugin level.
Hosting, maintenance, and the inertia problem
Hosting companies play an outsized role. Some managed hosts push updates and require fairly recent PHP versions for their customers, which is a big help. Others keep older stacks available to avoid breaking legacy sites. Patching PHP internally is possible, but custom builds can behave differently from official PHP and may introduce unexpected issues.
From the site owner’s perspective, many treat a website like a static object: if the site still works, there’s little appetite for change. Milan offers a practical counter: incremental maintenance is possible and necessary. You don’t need to rewrite everything overnight. Small, steady updates across plugins and themes and moving toward stricter typing and modern PHP features can make a big difference over time.
Security and performance gains from modern PHP
Upgrading unlocks two major wins:
– Security: Many exploit vectors that succeed on older PHP versions are neutralized by language-level protections in PHP 8 and later. This reduces the burden on sanitization and ad hoc fixes.
– Performance and resource efficiency: Newer PHP versions are measurably faster and use less memory. Milan highlighted that PHP 8.5 can be significantly faster than 7.4 and often uses much less RAM for the same workload — a compelling argument for hosts looking to reduce costs and increase density.
The ecosystem challenge
Plugins and third‑party libraries also shape adoption. Many modern libraries now require PHP 8.x, forcing plugin authors to update requirements if they want to benefit from those libraries. Popular plugins have moved on, but countless older or unmaintained plugins and themes remain a blocker. If a client depends on an abandoned plugin, upgrading PHP can break functionality — which makes site owners cautious.
Vulnerability Lab: a hands‑on demonstration tool
To make these threats tangible, Milan built the Vulnerability Lab plugin for his talk. It demonstrates how identical code behaves differently across PHP versions, showing real cases such as authentication bypass and SSRF that succeed on legacy PHP but are neutralized on newer versions. It also visualizes performance differences, including memory usage.
The plugin is aimed mainly at developers and agencies: run it on different environments to compare outcomes, use it to explain risks to clients, and to validate how code changes behave across PHP versions. It’s open source on GitHub and Milan plans to add more examples and a pattern library showing how to modernize common legacy coding patterns and which PHP version supports each improvement.
Practical recommendations
– Start small and be gradual: introduce stricter typing, replace deprecated functions, and adopt new attributes bit by bit. You don’t need to refactor an entire codebase at once.
– Hosts should accelerate adoption where feasible: forcing recent PHP versions helps the whole ecosystem, but it requires support workflows to handle breakages and client education.
– Plugin and theme authors should set realistic minimums: declaring PHP 8.x as a minimum requirement helps move the ecosystem forward and lets authors take advantage of improved language features.
– Combine efforts: newer PHP features complement WordPress core security best practices. Keep using escaping, sanitization, and other WordPress protections in combination with language‑level hardening.
Where to learn more
Milan recommends checking php.net for upcoming features and detailed change logs — PHP releases are planned well in advance, and the site is the authoritative resource. The Vulnerability Lab plugin on GitHub is a practical way to see examples in action and is open for contributions. Milan invites developers to reach out via the contact details he shared at WordCamp and to collaborate on building a community pattern library.
Conclusion
Legacy PHP is not just an abstract technical debt: it represents thousands of known issues and a growing attack surface. Upgrading to modern PHP versions delivers immediate security and performance benefits and makes future maintenance and library compatibility easier. The path forward is incremental: educate site owners, update plugins and themes gradually, and push for broader adoption so the WordPress ecosystem becomes more secure and efficient over time.