PHP End of Life in 2026: Is Your PHP Version Still Safe, and What Should You Do?

How PHP support works

Each PHP release branch gets two years of active support, with bug and security fixes, followed by two years of security fixes only. After that it is end of life: no more releases from the PHP project, whatever is discovered. A new branch arrives every November, so a PHP version you installed four years ago is either at or past the end of its life.

End of life does not mean your site stops working. It means new vulnerabilities in that version will never be fixed by PHP, your hosting provider will eventually remove it, and modern plugins and frameworks will stop supporting it. Laravel 13, for example, requires PHP 8.3 or newer, and WordPress plugins increasingly require PHP 8.

Why it matters more after PHP2Shell

The PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) affect PHP all the way back to 5.4 and can let an attacker run code on a server without logging in. PHP released fixed builds for 8.2 to 8.5 only. For 7.4, 8.0 and 8.1 it published source patches that a vendor or skilled administrator must apply by hand, and for PHP 7.3 and older there is no fix at all. CISA suggested that organisations unable to update, or running PHP 8.1 or older, consider taking those systems offline.

That is the real cost of end of life: when a serious bug appears, you have no quick, supported way to fix it. Every month on an unsupported version is a month where the next critical bug turns into an emergency project.

Your three options

Upgrade PHP in place. If the application is reasonably modern (written for PHP 7.x, using Composer, on a framework such as Laravel or Symfony, or a well-maintained WordPress site), upgrading to PHP 8.4 or 8.5 is usually a few days to a few weeks of work: fix deprecated functions, update dependencies, test, and switch. Tools such as Rector automate much of the code change. This is the cheapest option and the right one for most sites.

Buy extended support. Some Linux distributions and commercial long-term-support vendors backport security fixes to old PHP versions. This buys time but costs money every year, does not fix compatibility with modern libraries, and depends on the vendor responding quickly to the next critical bug.

Migrate to a modern stack. If the code is PHP 5-era, has no tests, uses a dead framework such as CodeIgniter 2 or a custom one, and the original developer is gone, an upgrade can cost almost as much as a rebuild and leave you with the same fragile code. In that case a phased migration to Node.js, Next.js or Python and Django often gives you more for the money: supported technology, faster pages, easier hiring and an architecture ready for APIs, mobile apps and AI features.

How to decide in one afternoon

Answer four questions. What exact PHP version runs in production? Does the code use a maintained framework or CMS? Is there automated testing or at least a staging site? Does the business plan significant new features in the next two years? A maintained framework and modest plans point to an upgrade. Old custom code, no tests and big plans point to a migration.

If you cannot answer the questions yourself, a short technical audit will. At WebsNexus, an audit reviews the code, dependencies, hosting and security posture and gives you a written recommendation with a fixed quote for the upgrade or the migration, so you can compare both before committing.

What to do before 31 December 2026

If you are on PHP 8.2, schedule the move to 8.4 or 8.5 now; it is usually a small step. If you are on 8.1 or older, patch PHP2Shell first with a backport or mitigation, then commit to a date for the upgrade or migration. Either way, make sure you have tested backups, uptime monitoring and someone responsible for applying security updates every month.