PHP end of life means the PHP project stops releasing security fixes for that version. As at late 2026, PHP 8.1 and all older versions are already end of life. PHP 8.2 loses its remaining security support on 31 December 2026. Check which version your site runs now, and plan a move to a supported PHP version before that date arrives.
This article covers what active support and security support mean in practice, the end-of-life dates for PHP 7.4 through PHP 8.5, the security risks of running an EOL PHP version, how to find out which PHP version your website uses, and what the move to a supported version involves.
What PHP End of Life Means
Active support is the full development phase: the PHP project issues bug fixes, new features, improvements and security fixes during this period. Security support is the final phase - only critical security issues are patched, with no new features or general improvements. When security support ends, the version is end of life. After that point, no further fixes of any kind come from the PHP project.
Within a supported release branch, point releases - such as 8.3.35 and 8.3.36 - carry those fixes to users. Once a version is end of life, no point releases follow. Any security issues found after the EOL date go unaddressed in that version.
PHP End-of-Life Dates for Recent Versions
The table below covers PHP 7.4 through PHP 8.5, taken from php.net's supported versions page.
| PHP version | Active support until | Security support until / end of life |
|---|---|---|
| PHP 8.5 | 31 Dec 2027 | 31 Dec 2029 |
| PHP 8.4 | 31 Dec 2026 | 31 Dec 2028 |
| PHP 8.3 | ended 31 Dec 2025 | 31 Dec 2027 |
| PHP 8.2 | ended 31 Dec 2024 | 31 Dec 2026 |
| PHP 8.1 | ended | end of life 31 Dec 2025 |
| PHP 8.0 | ended | end of life 26 Nov 2023 |
| PHP 7.4 | ended | end of life 28 Nov 2022 |
PHP 7.4 and PHP 8.0 have been end of life for several years. PHP 8.1 reached end of life on 31 December 2025. PHP 8.2 currently still receives security patches, but that window closes at the end of this year.
PHP 8.2 Loses Security Support on 31 December 2026
PHP 8.2 security support ends on 31 December 2026. After that date, the PHP project will not issue further security fixes for PHP 8.2, making it end of life from 1 January 2027. If your site is running PHP 8.2, plan the move to PHP 8.3, 8.4 or 8.5 before the year ends. Staying on PHP 8.2 into 2027 puts it in the same position PHP 8.1 is in today - no official fix route for any new vulnerability that emerges.
Why Unsupported PHP Is a Risk to Your Website
The October 2026 PHP2Shell event shows what this looks like in practice. Two critical vulnerabilities - CVE-2026-109618 and CVE-2026-109619 - were found in PHP's core request handling, both rated 9.2 out of 10 on the CVSS v4.0 scale. The attack class is unauthenticated remote code execution: an attacker can send a crafted web request and run their own code on the server without any login. The PHP project issued fixes for PHP 8.2 through 8.5. PHP 8.1 and older received no official fix.
Running an end-of-life PHP version during PHP2Shell left those sites without an official patch. Some Linux distributions and long-term support vendors provide backported fixes for their own supported releases - ask your host whether one is available for your specific setup. If one is, ask how long that cover lasts. An EOL PHP version will be in the same position with every serious flaw found from here on.
For the full detail on PHP2Shell - which setups are affected, which fixed versions apply, and what to ask your host - see our PHP2Shell: is your website affected article.
Does This Affect WordPress Sites?
Yes - WordPress runs on PHP, so any WordPress site is subject to its server's PHP version. Keeping WordPress and its plugins updated is always the right practice, but those updates do not change the PHP version the web server uses. That version is set at the server level, not inside WordPress, and it is what needs to change when a PHP upgrade is needed.
How to Check Your PHP Version
Your hosting control panel is usually the quickest route - it is the same place you would manage email accounts, databases or domain settings, and most show the PHP version under PHP settings, software or server configuration. On a WordPress site, go to Tools > Site Health > Info > Server and look for the PHP version row.
If neither of those gives a clear answer, ask your host directly. One useful distinction to raise when you do: the PHP version on the command line can differ from the version serving your website's live traffic. Ask your host to confirm the PHP version handling your web requests specifically, not the account's default.
Do not create a phpinfo file and upload it to check. There are simpler alternatives, and leaving that output exposed publicly adds its own security issues.
How to Move to a Supported PHP Version
A PHP upgrade is a server-level change made by your host or developer, not something done from inside WordPress or a website admin panel. Before any live change is applied, test on a staging copy first. Older plugins, themes or custom code written for an earlier PHP version may not run correctly on a newer one, and it is better to find that out in testing than after the live site breaks.
If you are moving from PHP 8.1 or an older version, move to the newest supported PHP version you can, rather than stepping up one version at a time. A site that moves to PHP 8.5 has security support until the end of 2029; PHP 8.4 has it until the end of 2028. The PHP project's migration guides cover the deprecations and removals introduced in each new version - share them with your developer before testing begins.
What If Your Site Can't Be Upgraded?
Some sites rely on older plugins, themes or custom code that will not run on a current PHP version without changes. In that position, the code needs updating - or the site does.
Our redesigns are always a full rebuild onto our platform, not a rework of an existing WordPress or Wix install. Typical timelines are 4-6 weeks, depending on how quickly feedback comes back. If your site is stuck on an end-of-life PHP version because legacy code cannot be updated without significant work, a rebuild is often the more practical route. Our website redesign services page covers what is involved.
PHP End of Life FAQs
On our platform, security patches and updates are handled as part of your plan - including the software your site runs on. Every plan includes backups, restoring from a backup is included at no extra cost, and if a site on our platform is compromised, putting it right is covered. Our managed websites page sets out what each plan includes. Or get in touch to talk through your site's PHP version and what to do next.
Is it illegal or non-compliant to run end-of-life PHP?
No law names a specific PHP version, and running software past its end-of-life date is not in itself unlawful. That said, running software with no available security fixes makes it harder to demonstrate that you keep systems and data appropriately secure. Staying on supported PHP versions is the straightforward way to maintain that position.
Will my host upgrade PHP for me?
It depends on the host. Some managed hosting providers apply PHP upgrades automatically or make them available with minimal steps; others leave it to the account holder to arrange. Check your host's documentation or ask them directly. Whatever the arrangement, requesting a test on a staging copy before the live switch is worth doing - a PHP version jump can affect compatibility with older plugins, themes or custom code.
Can I stay on PHP 8.1 if my host backports fixes?
Backported patches from a Linux distribution or long-term support vendor can address specific known vulnerabilities on end-of-life PHP versions. They are not the same as a supported PHP version: you get whatever the vendor chooses to backport, for as long as the vendor supports it. If your host confirms backported patches are in place, that reduces some immediate risk. It is not a long-term position to hold.
How often do PHP versions reach end of life?
The dates in the table above show the pattern. Each release branch typically receives around two years of active support, followed by roughly two more years of security-only support. The table also shows a new branch arriving roughly once a year, so there is a newer supported version to move to well before yours reaches end of life.
Callum Robley
Founder & Lead Developer, Tea Powered Projects
Callum is a full-stack developer and the founder of Tea Powered Projects, a web design, development, and hosting company based in Nottingham, UK. With over 15 years of industry experience, he specialises in building reliable, scalable digital solutions for businesses of all sizes.
