PHP lifecycle
PHP end of life dates and supported versions
Under its current policy, the PHP project supports each branch for four years, then it reaches end of life. This page lists the dates for each branch from 7.4 to 8.5, explains what PHP 8.2's end of life on 31 December 2026 means, and sets out the options for servers still on a retired branch.
Last reviewed against php.net, the NCSC and CISA.
The short answer
On 27 October 2026 the PHP project supports four branches: 8.2, 8.3, 8.4 and 8.5. PHP 8.2 reaches end of life on 31 December 2026, then 8.3 on 31 December 2027, 8.4 on 31 December 2028 and 8.5 on 31 December 2029. PHP 8.1 and all older branches are already end of life and get no new releases.
Supported versions
PHP end of life dates, branch by branch
The security support date is the end of life date: after it, the PHP project makes no further releases on that branch.
| Branch | First release | Active support ends | Security support ends | Status on 27 Oct 2026 | PHP2Shell fix |
|---|---|---|---|---|---|
| PHP 8.5 | 20 Nov 2025 | 31 Dec 2027 | 31 Dec 2029 | Active support | 8.5.12 |
| PHP 8.4 | 21 Nov 2024 | 31 Dec 2026 | 31 Dec 2028 | Active support, moving to security fixes only on 1 Jan 2027 | 8.4.27 |
| PHP 8.3 | 23 Nov 2023 | 31 Dec 2025 | 31 Dec 2027 | Security fixes only | 8.3.36 |
| PHP 8.2 | 8 Dec 2022 | 31 Dec 2024 | 31 Dec 2026 | Security fixes only, ending this year | 8.2.35 |
| PHP 8.1 | 25 Nov 2021 | 25 Nov 2023 | 31 Dec 2025 | End of life. Final release 8.1.34 | No release; source-only backport |
| PHP 8.0 | 26 Nov 2020 | 26 Nov 2022 | 26 Nov 2023 | End of life. Final release 8.0.30 | No release; source-only backport |
| PHP 7.4 | 28 Nov 2019 | 28 Nov 2021 | 28 Nov 2022 | End of life. Final release 7.4.33 | No release; source-only backport |
Every branch older than 7.4 is also end of life. PHP 8.6 is not on php.net's supported versions table yet: its fourth release candidate, published on 21 October 2026, carries the PHP2Shell fixes but is not for production, and the PHP wiki's release timetable targets general availability on 19 November 2026.
Sources: php.net's supported versions and unsupported branches pages; first release dates for 7.4, 8.0 and 8.1 from php.net's changelogs, with active support ending two years after first release, the rule php.net applied to those branches; the PHP 8.6 timetable.
How support works
Active support, security support and end of life
Under php.net's current policy, each branch moves through three stages. Recent branches change stage on 31 December rather than on the anniversary of their first release, which is why so many of the dates above fall on the last day of the year.
Years 1 and 2
Active support
The first two years of a branch. Reported bugs and security problems are both fixed, and new point releases arrive on a regular schedule.
Years 3 and 4
Security fixes only
The next two years. Only critical security issues are fixed, and releases appear when they are needed rather than on a timetable. PHP2Shell is a case in point: 8.2.35 and 8.3.36 shipped alongside the active branches.
Years 5 onwards
End of life
Once both periods are over, the PHP project stops supporting the branch. It keeps running, but a flaw found from then on gets no new release from the PHP project, so whether it is ever patched depends on others.
31 December 2026
PHP 8.2 end of life: what to do before 31 December 2026
PHP 8.2 has had security fixes only since the end of 2024, and its support ends on 31 December 2026. The 8.2.35 release of 21 October 2026 fixes PHP2Shell, but a PHP flaw found from 1 January 2027 onwards will get no 8.2 release from the PHP project.
-
Step 1
Patch to 8.2.35 now
It closes PHP2Shell on the branch you run today. A move between branches takes longer and should not hold up the security fix.
-
Step 2
Check what your software accepts
Each application sets its own range of PHP versions, and that range usually decides your target.
PHP requirements by platform -
Step 3
Choose a target branch
8.3 adds one more year, to 31 December 2027. 8.4 runs to 31 December 2028 and 8.5 to 31 December 2029, so a newer target means longer before you repeat the exercise.
-
Step 4
Read the migration notes and test
php.net publishes a migration guide for each branch listing what changed. Work through the guides between your branch and the target, then test a copy of the site on the new version.
-
Step 5
Switch, then confirm
Change the version before 31 December and check that the site really runs the new one afterwards.
How to check your PHP version
Migration guides on php.net
Two things to know
- PHP 8.4 changes stage on the same day. It leaves active support and moves to security fixes only, which it keeps until 31 December 2028. That does not make it a poor target.
- A supplier's package can have its own dates. If your PHP 8.2 comes from a Linux distribution or a long-term support vendor, the supplier may keep patching its package after php.net stops. Check its published policy rather than assuming either way.
End of life and PHP2Shell
What end of life means for PHP2Shell
The fixed releases of 21 October 2026 cover the four supported branches, 8.2 to 8.5. For 8.1 and older there is no new release: php.net states that those branches no longer receive updates from the PHP project.
The government guidance is correspondingly firm. The US CISA advises taking PHP systems offline if they cannot be updated immediately or if they run PHP 8.1 or earlier, and on 26 October 2026 it added both vulnerabilities to its Known Exploited Vulnerabilities catalogue. The UK's NCSC says that where a system can be neither updated nor mitigated in time, organisations should consider taking it offline until it can be fully mitigated.
Should I take my website offline?The minimal backports for 7.4, 8.0 and 8.1
php.net's advisory says that, because of the severity, the PHP security team prepared minimal source backports for PHP 7.4, 8.0 and 8.1, aimed at people who build PHP from source or have no long-term support vendor.
- Where they are. Three branches in the official php-src repository on GitHub:
PHP-7.4-CVE-2026-109618-109619,PHP-8.0-CVE-2026-109618-109619andPHP-8.1-CVE-2026-109618-109619. - What they contain. Each ends in a commit dated 18 October 2026 that names both CVEs and describes itself as a minimal mitigation for an end-of-life version.
- How you get them. As source code only. There is no new version number and no packaged release, so using one means compiling PHP yourself from that branch.
- What they do not do. Return the branch to support. If PHP reaches you through a distribution, host or vendor, ask that supplier whether its package includes the fixes rather than building your own.
Sources: php.net security advisory, 21 October 2026; php-src on GitHub
Stuck on an old branch
Your options if you cannot leave PHP 8.1 or older yet
None of these is right for every server, and several can run side by side: a patched package or a temporary restriction now, an upgrade to a supported branch next. This page names no suppliers.
Upgrade to a supported branch
The only way back to fixes from the PHP project itself. It often means upgrading the application on top of PHP as well, which is where most of the work lies.
The catch: Needs testing time, so it rarely solves this week's problem on its own.
Upgrade routes by platform
Use your distribution's or supplier's packages
If PHP came from a Linux distribution, a hosting company or an appliance vendor, that supplier may patch branches php.net has retired. php.net says some distributions do. Look up both CVE numbers in the supplier's security tracker.
The catch: The version number may look old even when the fix is in, so check the package, not the number.
Reading backported versions on Linux
Buy extended support
Commercial long-term support for retired PHP branches exists, and php.net notes that LTS vendors received the PHP2Shell patches before the public release. Compare what each offer covers, how quickly fixes arrive and whether it supports your operating system and application.
The catch: A paid bridge, not a destination: you still need a plan to reach a supported branch.
Build from the minimal backport
For teams that already compile PHP from source, the PHP security team's backport branches add the PHP2Shell fix to 7.4, 8.0 and 8.1.
The catch: Covers these two CVEs only. The branch is still end of life.
The backports, explained
Contain the risk while you move
Restrict who can reach the site, apply the PHP project's interim settings, or take the system offline until it is fixed, as CISA and the NCSC advise for systems that cannot be updated quickly.
The catch: Reduces exposure; does not remove it.
The interim settingsQuick answers
PHP end of life questions, answered
When does PHP 8.2 reach end of life?
On 31 December 2026. PHP 8.2 left active support on 31 December 2024 and has received security fixes only since then. Its latest release, 8.2.35, fixes PHP2Shell, but after its end of life the PHP project makes no more 8.2 releases.
I'm on PHP 7.4, 8.0 or 8.1: is there a fix for PHP2Shell?
There is no new release from the PHP project. Its security team did publish minimal source-code backports for 7.4, 8.0 and 8.1, as branches in the php-src repository on GitHub, for people who build PHP themselves. Some Linux distributions and long-term support vendors also ship patched packages, so ask whoever supplies your PHP.
CISA's guidance is to take PHP systems offline if they run PHP 8.1 or earlier. The lasting answer is a move to a supported branch.
What is the latest version of PHP?
PHP 8.5.12, released on 21 October 2026, is the newest stable release. The latest release on each other supported branch is 8.4.27, 8.3.36 and 8.2.35. PHP 8.6 is in testing: its fourth release candidate came out on 21 October 2026, release candidates are not for production use, and the PHP wiki's timetable targets general availability on 19 November 2026.
Is PHP still safe to use?
Yes, on a supported branch kept up to date. When PHP2Shell was disclosed, fixed releases for all four supported branches came out with the advisory. The danger sits with servers on end-of-life branches and servers nobody updates.
What is the difference between active support and security support?
During active support, the first two years, the PHP project fixes bugs and security problems and ships regular point releases. During security support, the two years after that, it fixes critical security issues only and releases as needed. After both, the branch is end of life.
Does end of life mean my site stops working?
No. An end-of-life PHP branch keeps running exactly as before. What stops is the supply of fixes, so the next serious flaw, like PHP2Shell, may have no patch for your version.
Which PHP version should I move to?
The newest supported branch your application accepts. 8.4 and 8.5 give the longest support, to the end of 2028 and 2029. If your application tops out at 8.3, that still covers you to the end of 2027 while you plan the next upgrade.
Know your exposure
Find every PHP server you run
Patching the server you know about is the easy part. A vulnerability scan finds the forgotten staging site, the old microsite and the appliance with PHP inside, then tells you which ones are still exposed.