PHP end-of-life dates and supported versions

How does PHP support work?

Each PHP release branch gets two years of active support, with bug and security fixes, followed by two years of security fixes only. After that it is end of life: no more releases from the PHP project, whatever is discovered.

A new branch arrives every November, so a PHP version installed four years ago is at or past the end of its life.

Is my PHP version safe?

• Active support (8.4, 8.5): safe, as long as you install each patch release.
• Security fixes only (8.2, 8.3): safe for now, but plan the upgrade. PHP 8.2 stops getting fixes on 31 December 2026.
• End of life (8.1 and older): new vulnerabilities will never be fixed by the PHP project. Upgrade or migrate.
• Not sure which version you run? Check it in cPanel, in WordPress under Tools → Site Health, or with php -v on the server.

How do I upgrade from an unsupported PHP version?

From PHP 8.2 or 8.3, moving to 8.4 or 8.5 is usually a small step: update dependencies, fix deprecations, test on staging and switch.

From PHP 7.x, upgrade one major step at a time with the official migration guides, and use a tool such as Rector to automate the code changes.

From PHP 5.x with no tests and a dead framework, an upgrade can cost almost as much as a rebuild. Compare it with a phased migration before you commit.

Which critical vulnerabilities affect old PHP versions?

• CVE-2026-109618

  PHP2Shell: remote code execution without logging in.

  Affected: PHP 5.4 and later. Fixed builds for 8.2–8.5; source patches only for 7.4–8.1.

• CVE-2026-109619

  PHP2Shell: the second flaw in the same disclosure.

  Affected: PHP 5.4 and later. Fixed builds for 8.2–8.5; source patches only for 7.4–8.1.