Wordpress Complains About PHP Version

[ash34]

Now that Wordpress complains about PHP version 8.2.29 and that the minimum recommended version of PHP is 8.3, how to update?

[JedMeister]

Hi @ash34

That occurs time to time when a PHP version becomes "end of life" (EOL). As you may already be aware - or may be obvious, that means that the PHP developers no longer provide any fixes - including security related fixes.

However the default PHP install we provide (i.e. 8.2) comes from Debian, not directly from PHP devs. Debian devs work with PHP devs and other Linux devs from distros such as Ubuntu, SUSE Linux, Red Hat Enterprise Linux, etc develop backported security fixes for the PHP 8.2 packages. The default TurnKey config will auto install these new security updates as they are released by Debian.

Our current v18.x appliances are based on Debian 12/Bookworm. So the included Debian PHP 8.2 package will receive security updates at least until June 30, 2028.

So while WordPress recommend using a version of PHP that is still supported upstream, they note on their requirements page (towards the bottom):

[...] WordPress also works with PHP 7.2.24+ [...]

They go on to mention potential security issues - but I've covered that above.

We do hope to have a new v19.x batch of appliances (based on Debian 13/Trixie) ASAP. Debian 13/Trixie includes PHP 8.4.

---

In the meantime, you have a few options:

• Stick with the Debian PHP packages & ignore the warning. The upside is that you don't need to do anything - at least for now. The downsides are:
  • the admin page warning
  • there may be (but not always) performance improvements with the newer PHP
  • some third party plugins/modules may end support for older versions of PHP at some point - FWIW more popular plugins/modules will usually support older PHP versions, but less popular and/or ones with smaller dev teams may not. That is obviously a potential issue if future plugin releases provide security fixes.
• Update PHP on your current server. The downside of that is that you will no longer automatically get PHP security updates, you will need to manually update PHP when security issues come to light.
  • FWIW we provide a PHP upgrade script - detailed below.
• Manually upgrade the base Debian OS. The downsides of that are that it's a non-trivial process that can be a bit involved and will leave you with a hybrid "TurnKey v18.x on Debian 13/Trixie" OS.

---

If you would like to upgrade PHP on your current system, then the best path is to use the updated packages from deb.sury.org. The guy that provides those packages is a trusted third party and he's also a Debian and Ubuntu developer that is involved in the "official" Debian/Ubuntu packages and is involved in developing the security patches that are applied to the older PHP packages that you are already getting.

There are instructions there on how you can do that manually update PHP. But additional steps are required to enable the new PHP version on your server.

Alternatively, we provide a tkl-upgrade-php script that can upgrade PHP and enable the newer PHP version. We plan to install that by default in future releases, but you can download and run it like this (assuming root):

wget https://raw.githubusercontent.com/turnkeylinux/common/refs/heads/18.x/overlays/php/usr/local/bin/tkl-upgrade-php
mv tkl-upgrade-php /usr/local/bin/
chmod +x /usr/local/bin/tkl-upgrade-php

Then run it:

tkl-upgrade-php

It has been tested pretty well, but as it's not yet included by default there is a chance of bugs we didn't hit in our testing. So if you have any issues, please open a new issue.

[ash34]

Thanks for this.

I tried the script to update to 8.3 and although it ran and completed in a few seconds the website was not functional after that. A reboot could not fix it.

I tried

cp -R /etc/php/8.2/* /etc/php/8.3/

Followed by a reboot but that did not solve it either. Had to rollback the server.

Unless there's a relatively easy fix I will stay with 8.2 and ignore the Wordpress warnings.

BTW...

I also notice that after the script is run the Webmin page for PHP still points to the old version but this is easily solved in the UI after clicking the configuration gear icon.

[JedMeister]

That sucks that it didn't work :( Thanks for reporting back though. Your feedback is invaluable.

It would be useful to see what the actual error was (should be some info in the apache logs) but obviously that's not an option now you've rolled back. When I get a chance I'll have a look myself.

[marcos-mendez]

Hi @ash34,

Just to clarify — the message you're seeing in WordPress is a recommendation, not a requirement. PHP 8.2 (which ships with Debian Bookworm / TurnKey v18.x) is fully supported.

Here's the official compatibility matrix:

• WordPress 6.8 is fully compatible with PHP 8.0, 8.1, and 8.2 (source: make.wordpress.org)
• WordPress still works with PHP as old as 7.2.24+ (legacy mode)
• PHP 7.2/7.3 support will only be dropped in WordPress 7.0 (April 2026), and even then, the minimum becomes 7.4 — not 8.3
• PHP 8.3 is labeled as "recommended" since WordPress 6.8, but "recommended" ≠ "required"

The dashboard notice is informational — it does not mean your site is broken, insecure, or incompatible. Your site on PHP 8.2 is perfectly fine and will continue to receive WordPress security updates.

A word of caution about always chasing the latest PHP version:

Running bleeding-edge software in production is generally a bad practice. PHP 8.2 is the version packaged by Debian Bookworm — it's been thoroughly tested, it receives security patches from Debian's security team, and it's the version that all TurnKey LAMP-based appliances are built and tested against.

Upgrading PHP independently from the distribution can introduce:

• Plugin/theme incompatibilities (many plugins are tested against 8.2, not 8.3/8.4)
• Broken extensions (some PHP modules may not be available for the newer version)
• Loss of Debian security update coverage (third-party PHP repos have different support timelines)
• Conflicts with other system packages

The tkl-upgrade-php script (contributed by @marcos-mendez from POPSOLUTIONS) is available for users who specifically need a newer PHP version, but it should be used with caution and only when there's a concrete requirement — not just because of a dashboard notice.

TL;DR: PHP 8.2 on TurnKey v18.x is fully compatible with current WordPress. The notice is cosmetic. Don't fix what isn't broken.

Hope this helps!

— Marcos Méndez (POPSOLUTIONS)

[OnGle]

With this in mind, I'm incline to add wont-fix label to this, or create a new "non-bug-warning" label. Thoughts? @JedMeister

[marcos-mendez]

Hey @OnGle good to see you man!

Just my point of view

This appears to be an upstream recommendation warning rather than a TurnKey bug.

WordPress currently recommends PHP 8.3+, but lower versions may still be supported. In this case, the appliance is shipping a PHP version that triggers the WordPress recommendation notice, but that does not by itself indicate a packaging or runtime defect. Also if done correctly the tkl-upgrade-php script is working as I said on #2074

Per Debian-style bug triage, if this is not considered a real bug, the most appropriate action is to close the issue with an explanation rather than add a custom label. The wontfix tag is more appropriate for real bugs that are acknowledged but intentionally not fixed.

Closing this issue.

[OnGle]

Good points all round.