#225 – Milan Petrović on the Risks of Legacy PHP in WordPress and Why Upgrading Matters for Security

Milan Petrović, a WordPress developer with nearly 20 years of experience, discusses the security and performance risks of running outdated PHP versions in WordPress. He highlights that PHP 7 and PHP 5 have 3,000–4,000 open, unfixed bugs — many security-related — making sites running these versions vulnerable to automated exploitation. PHP 8.x not only closes these security holes but also delivers over 50% performance improvement and significant memory reduction compared to PHP 7.4. Milan advocates for WordPress to declare PHP 8.0 as the minimum supported version to push the ecosystem forward, while acknowledging the challenge of millions of sites still on legacy versions. He also introduces his open-source Vulnerability Lab plugin, which lets developers compare how exploits behave across PHP versions, serving as a practical tool for agencies to demonstrate risks to clients.