This episode of the Jukebox Podcast on WP Tavern features Milan Petrović, a WordPress developer who’s been active since 2007. Milan runs Dev4Press and recently joined Freemius as a full‑stack developer. His WordCamp Europe talk focused on the security and performance risks of running legacy PHP in WordPress sites, and why moving to modern PHP (PHP 8.x and beyond) should be a priority for developers, hosts, and site owners.

Why PHP version matters

Many WordPress users see a PHP version number in a control panel but don’t appreciate its practical impact. Milan explains that newer PHP releases do more than add features: they close language‑level vulnerabilities, introduce safer behaviors by default, and deliver substantial performance and memory improvements. Those changes can neutralize entire classes of exploits — for example, authentication bypasses or server‑side request forgery — that easily affect sites running older PHP branches.

The cost of compatibility

WordPress’ long commitment to backwards compatibility helped its adoption but also slowed upgrades. Core and plugin ecosystems still need to support many older PHP versions because millions of sites run on them. That wide support is useful, but it leaves a large attack surface: Milan cites thousands of open, confirmed bugs affecting older PHP branches that will never be fixed. Publicly documented bugs become recipes for automated exploitation, so remaining on end‑of‑life PHP is effectively inviting attacks.

Hosts, libraries, and the upgrade blockers

Hosting providers play a decisive role. Managed hosts that push newer PHP versions can rapidly improve security and speed for their customers, and modern PHP can reduce memory use and increase throughput — freeing resources and lowering costs. That said, upgrading servers requires investment and careful support, because changes can break legacy plugins or custom code.

Third‑party libraries also drive upgrades. Many libraries have already raised their minimum PHP requirements to 8.x to use newer language features and security fixes. If your plugin depends on such a library, you may be forced to upgrade PHP anyway.

Why PHP 8 helps

PHP 8 introduced important safeguards and modern language constructs that make secure coding easier and more reliable. Beyond closing specific vulnerabilities, newer PHP versions support stricter typing, attributes, and other patterns that reduce common mistakes. Milan notes dramatic performance jumps across PHP versions: newer releases can be tens of percent faster and use significantly less memory for the same code path.

Vulnerability Lab plugin: a teaching tool

To demonstrate these differences, Milan created the Vulnerability Lab plugin. It contains examples that behave differently depending on the PHP version. Running the plugin on older PHP can reproduce exploitable behaviors or fatal errors, while running it on modern PHP shows how the same code can be made safe. The plugin is aimed at developers and agencies as a way to explain risks to clients and to test how code will behave across PHP versions. It’s available on GitHub, and Milan plans to expand it with more patterns and examples.

Practical advice: how to move forward

Milan’s recommendation is incremental modernization, not an all‑at‑once rewrite. Steps he suggests:
– Start requiring a newer minimum PHP for new projects (many developers now target 8.0+).
– Make small code updates such as stricter typing, replacing deprecated functions, and adopting safer PHP constructs.
– Test plugins and themes on newer PHP versions in staging environments before promoting changes to production.
– Hosts should offer clear upgrade paths and communication so site owners aren’t surprised when something breaks.
– Use the Vulnerability Lab and similar tools to demonstrate issues to nontechnical stakeholders and clients.

A combined approach is best: keep using WordPress core security practices like escaping and sanitization, and also embrace the language‑level protections and performance of modern PHP.

Where to learn more

Milan recommends following the official PHP site for upcoming releases and change logs, tracking WordPress resources for ecosystem guidance, and reviewing third‑party library requirements that may force upgrades. The podcast show notes at wptavern.com/podcast include links to Milan’s WordCamp presentation on WordPress.tv and the Vulnerability Lab GitHub repository. Milan is open to contact via the links provided in those resources for pointers and contributions.

Bottom line

Running end‑of‑life PHP significantly increases security risk and limits performance. While WordPress’ need to support a diverse user base makes immediate shifts difficult, gradual adoption of PHP 8.x features across core, plugins, and hosting platforms will reduce vulnerabilities, improve efficiency, and make the WordPress ecosystem more resilient. Milan’s message: start small, test thoroughly, and use the modern PHP toolset to build plugins and sites that are secure by design.

Milan Petrović, a long‑time WordPress developer and Freemius full‑stack engineer, recently spoke at WordCamp Europe about an issue most site owners and some developers underestimate: the risks of running legacy PHP with WordPress, and the concrete gains of moving to modern PHP versions such as PHP 8.x.

Why PHP versioning matters

Many WordPress users notice a PHP version number in their hosting control panel but don’t appreciate what it actually affects. Milan’s message is simple: PHP isn’t just an implementation detail — its version dramatically impacts security, performance, and memory usage. PHP 8 introduced language features and internal hardening that neutralize entire classes of exploits that were common or unavoidable on older branches like PHP 7 and earlier.

The downside of extreme backwards compatibility

WordPress’ commitment to backwards compatibility helped the platform scale massively. It made hosting inexpensive and approachable for millions of sites. But that same policy has a downside: it slows adoption of safer, more modern server environments.

Milan points out that older PHP branches accumulate thousands of open, confirmed bugs that will never be fixed. Those publicly documented vulnerabilities become a roadmap for automated attacks that are agnostic to your CMS — attackers target the server runtime itself. While some hosts compile and patch custom PHP builds, that can introduce other differences and unknown quirks. Relying on patched, out‑of‑support branches is not a long‑term fix.

Security, performance, and cost benefits of PHP 8.x

Upgrading to modern PHP versions delivers multiple, immediate benefits:
– Security: Native language changes and stricter behaviors in PHP 8 blunt many common exploit techniques (authentication bypass, SSRF patterns, and more) that would otherwise work against legacy code.
– Performance: Newer PHP releases are significantly faster. Milan highlights large gains in execution speed and reduced memory consumption — meaning hosts can run more sites with the same resources.
– Maintainability: Modern PHP enables stricter typing and language features that make code clearer and easier to harden.

Who should act and how

This is a message for several audiences:
– Hosting companies: Migrating customers to newer PHP versions frees resources and reduces exposure. Managed hosts are already moving users forward, but migration requires testing and support to avoid breaking customer sites.
– Plugin and theme developers: Declare and adopt a sensible minimum PHP requirement (Milan has set 8.0+ for his plugins) and incrementally modernize code to use safer patterns and features.
– Site owners and agencies: Treat your site like maintained equipment — periodic upgrades matter. Where legacy plugins or custom code prevent immediate upgrades, plan staged migrations and testing.

Why WordPress can’t flip a switch — but what it can do

Technically, WordPress is already compatible with modern PHP versions, so setting a higher minimum is possible. The practical obstacles are the huge ecosystem of plugins, themes, and non‑technical site owners who depend on older code. Milan argues the right approach is gradual: declare a newer minimal PHP requirement to nudge the ecosystem, then modernize core and plugins over time. Even small, incremental changes — introducing stricter typing, using modern functions, adopting attributes — compound into a much safer codebase.

Vulnerability Lab: a practical demonstration

To illustrate the differences, Milan created a Vulnerability Lab plugin. It’s aimed at developers and agencies: install it on sites running different PHP versions to demonstrate how identical vulnerable code behaves across runtimes. Some examples show fatal errors on older PHP branches and safe execution on newer ones; others demonstrate memory and speed differences. The plugin is on GitHub and is intended to grow into a pattern library showing “old” vs “modern” approaches and which PHP versions support each pattern.

Use cases for agencies and maintainers

Agencies can use the Vulnerability Lab as a visual, practical tool to convince clients to modernize hosting or replace unmaintained plugins. Seeing a live demonstration of a broken plugin or a 50% memory improvement can turn abstract advice into an urgent, actionable task. Milan envisions a community‑driven collection of examples developers can use for testing and client reporting.

What to do next — practical steps

For developers and agencies
– Audit your plugins and themes for compatibility and upgrade paths. Prioritize popular or security‑sensitive components.
– Start small: introduce stricter typing and modern language constructs in non‑breaking ways, then expand gradually.
– Use tools and test environments to run code under multiple PHP versions and identify regressions.

For hosts
– Offer migration paths and automated testing tools so customers can move safely to newer PHP.
– Communicate benefits (security, speed, lower memory) clearly to less technical users.

For site owners
– Keep WordPress core, plugins, and themes updated.
– Talk to your host or developer about PHP upgrades and testing options before making changes on live sites.

Resources and learning

Milan recommends following the official PHP site for version changes and timelines, and watching how third‑party libraries increase their minimum PHP requirements. Those libraries often force upgrades faster than larger platforms because they don’t have to support millions of legacy sites.

Final takeaways

– Running end‑of‑life PHP leaves sites exposed to thousands of known issues that won’t be fixed; attackers can and do exploit these at scale.
– Modern PHP versions provide real, demonstrable benefits in security, performance, and memory usage. The gains are worth the migration effort.
– A pragmatic, community approach — gradual migration, improved tooling, developer guidance, and clear communication to site owners — will move the WordPress ecosystem forward.

Milan is available for further questions and has shared his Vulnerability Lab plugin and contact details in his WordCamp slides. If you’re responsible for sites, plugins, or hosting, start planning and testing PHP upgrades now: upgrading PHP isn’t optional maintenance — it’s core to keeping WordPress sites secure and performant.

Milan Petrović has been working with WordPress since 2007—building plugins (many for bbPress), running Dev4Press, and more recently joining Freemius as a full‑stack developer. At WordCamp Europe he presented “Secure by design: hardening plugins with PHP 8.x,” a practical call to modernize PHP usage across the WordPress ecosystem. The core message: running legacy PHP is a security and performance liability, and moving to modern versions like PHP 8.x gives you native protections, speed gains, and lower memory use.

Why PHP version matters

Many site owners see a PHP version number once in a hosting control panel and wonder why it matters. In truth, the PHP version determines the language features available, the security patches you receive, and the runtime behavior of your code. Newer PHP versions include both defensive language changes and performance optimizations that reduce attack surface and resource consumption.

Two points Milan emphasized:
– Security: Old PHP branches have thousands of open bug reports (Milan cited 3–4k open, confirmed bugs on older branches). Once a branch reaches end‑of‑life, those bugs won’t be fixed and details are public—making automated exploitation far easier. Some vulnerabilities operate below the application layer and affect any PHP site, not just WordPress.
– Performance and resources: Every PHP version brings performance improvements. Milan pointed out that recent PHP releases cut memory usage and increase throughput; for example, newer PHP versions can be 5–10% faster with each update and later releases (like 8.5) show much larger improvements—he noted up to a 50% performance gain compared with 7.4 in his tests. For hosts this translates to cost savings and capacity gains.

Why WordPress still supports old PHP

WordPress has a long history of prioritizing backward compatibility. That has driven adoption by keeping WordPress usable on inexpensive hosting and older server stacks. But it also means WordPress Core and many plugins continue to support PHP versions that are past their prime. While compatibility helped the ecosystem grow, it has slowed adoption of safer, more efficient PHP patterns.

What to watch out for with legacy PHP

– Public, unpatched bugs: End‑of‑life branches leave thousands of issues unaddressed and readable by attackers. This increases the likelihood of automated exploitation.
– Inconsistent server builds: Some hosts patch or custom‑build PHP for stability or performance. That can temporarily reduce risk, but it also introduces divergence from the official PHP implementation and unpredictability for developers.
– Library pressure: Third‑party PHP libraries often move faster than the WordPress ecosystem and may require newer PHP versions. Relying on modern libraries can effectively force plugin authors to upgrade their PHP requirements.

Who should act—and how

Milan’s message is aimed at everyone: hosting companies, plugin and theme developers, agencies, and site owners.

– Hosting companies: They can accelerate upgrades across many sites and collect big performance and cost benefits. Adoption is costly, and they must handle support when changes break sites, but the upside is large: fewer resources per site and improved security posture.
– Developers and agencies: Use PHP 8 features to harden code (strict typing, modern patterns, attributes, and other mitigations). Update plugins gradually—declare a reasonable minimal PHP version (Milan uses 8.0 for his plugins) and refactor incrementally.
– Site owners: Treat your site like maintained equipment. Regular updates, testing, and staged upgrades reduce risk. If you’re running an old plugin or theme that is no longer maintained, replace or rebuild it rather than keep it on an unsafe platform.

A practical demonstration: Vulnerability Lab

To make the differences visible, Milan created the Vulnerability Lab plugin (available on GitHub). It demonstrates how the same vulnerable code behaves differently on older vs newer PHP versions—showing practical examples like authentication bypasses and server‑side request forgery that succeed on legacy PHP but are neutralized by modern PHP protections. The plugin also shows memory and performance differences, making it useful for developers and agencies to illustrate risk and justify upgrade work to clients.

Recommendations and next steps

– Gradual modernization: You don’t have to convert everything at once. Start with safer defaults, stricter typing, and small refactors. Over time you can take advantage of newer language features.
– Community leadership: Milan suggests WordPress could help by moving faster to modern minimums (for example declaring PHP 8.x as the new baseline), which would nudge plugin authors and hosts to follow.
– Use reliable sources: Follow php.net for upcoming features and changes; it’s the best place to learn what each new PHP release brings. Also watch third‑party library requirements—those often force changes quicker than Core.
– Test and communicate: Hosts and agencies should provide testing environments across PHP versions so site owners and developers can validate changes before production upgrades.

Final thoughts

Upgrading PHP is both a security imperative and a performance opportunity. The path forward is collaborative: WordPress Core, plugin authors, hosts, and site owners all share responsibility. Milan’s Vulnerability Lab and talk aim to make the risks tangible and provide concrete patterns for hardening. Start small, test often, and use the native features of modern PHP to build more secure, efficient WordPress sites.

If you want to explore Milan’s examples, find the Vulnerability Lab plugin on GitHub and watch his WordCamp Europe presentation via the WP Tavern show notes. He’s open to questions and contributions and encourages everyone to work together to move the ecosystem forward.

In a recent Jukebox Podcast interview, Milan Petrović explained why moving away from legacy PHP is critical for WordPress sites — not just for performance, but for security. Milan has worked with WordPress since 2007, built many plugins (especially for bbPress), ran his own plugin company Dev4Press, and now works as a full stack developer at Freemius. His long experience gives him a clear view of how both the WordPress and PHP landscapes have changed and why staying on old PHP is dangerous.

Why PHP version matters

Many WordPress users notice a PHP version number in a hosting control panel and then forget about it. But PHP versions are not just background detail: they include language-level fixes and protections that close entire classes of vulnerabilities. Milan argues that PHP 8 marked a major milestone, introducing native behaviors that neutralize exploits which would succeed on older branches. Beyond security, newer PHP releases bring substantial performance and memory improvements — sometimes freeing up half the memory for the same code and improving speed dramatically.

The legacy problem and the tradeoff

WordPress has prioritized backward compatibility from early on, and that helped make it ubiquitous. The downside is that the core — and many plugins — still run on outdated PHP versions. Milan notes that many sites remain on PHP 7.4 or older, and there are thousands of open bug reports for older PHP branches that will never be fixed. Those public bug details can be used by automated tools and attackers, creating an active threat to sites that remain on unsupported PHP.

Who should act: hosts, developers, site owners

Milan makes the point that responsibility is shared. Hosting companies can drive adoption by offering and encouraging newer PHP versions; managed hosts are already doing this for many customers. Developers should modernize plugin and theme code to take advantage of PHP 8’s features and protections. Site owners, especially those with older, unmaintained plugins, need to be aware that a working site today may be exposing them to serious risk.

A practical path forward

Milan does not expect an immediate drop of support for PHP 7 across WordPress, but he recommends a clearer, faster move toward modern versions. One practical approach is for projects to declare a minimum supported PHP (for example PHP 8.0) and then modernize incrementally. Incremental changes can include stricter typing, replacing deprecated functions, and adopting small language features that reduce vulnerability surface. This phased strategy spreads work over time and avoids sudden breakages.

Vulnerability Lab plugin: a teaching tool

To demonstrate the differences between PHP versions, Milan created a Vulnerability Lab plugin for his talk. It lets developers run example exploit patterns and observe how identical code behaves under old and new PHP versions. Some examples show fatal errors on older versions but clean behavior on PHP 8, while others reveal how updated PHP reduces attack surface and memory use. The plugin is aimed mainly at developers and agencies: it can be used to show clients the concrete effects of upgrading or to test code on different PHP versions. The project is on GitHub and open to contributions.

Why this is also an operations and business issue

Upgrading PHP is not purely technical: it has operational and customer-facing implications. Hosts worry about breakages and the support overhead of migrating millions of sites. Agencies face clients who insist a site “just works” and resist change. Milan likens site maintenance to maintaining a bicycle: if you never look after it, parts will corrode and fail. The goal is not to force everyone abruptly, but to build awareness and enable a gradual migration that reduces risk and yields performance gains.

Third-party libraries accelerate the shift

Outside WordPress, many PHP libraries already require newer PHP versions. If a plugin depends on an external library that raises its minimum PHP, plugin authors are forced to follow. That ecosystem pressure is another reason WordPress and plugin developers will need to modernize: dependencies will push requirements forward independent of WordPress core policy.

Resources and next steps

For developers, the PHP official website documents upcoming releases and detailed change lists — a useful place to track what features and fixes land in each version. Milan advises using the combination of WordPress core security patterns (escaping, sanitization, nonces, etc.) together with modern PHP features. Start small: adopt stricter typing, replace old functions, and test components on newer PHP versions. For hosts and agencies, create safe upgrade paths, test environments, and clear communications for customers.

Conclusion

Milan’s message is straightforward: legacy PHP is an avoidable risk. Upgrading brings security protections, performance improvements, and long-term maintainability. It will require coordinated effort from WordPress leadership, hosting providers, plugin authors, and site owners, and it’s realistic to proceed gradually. Tools like the Vulnerability Lab can help make the differences visible and persuasive, turning abstract advice into concrete evidence for upgrading.