Daniel Lasek · Last reviewed 2026-11-03
Laravel Versions: Which Still Get Security Fixes?
As of November 3, 2026, only Laravel 12 and Laravel 13 get security fixes. Laravel 12 is supported for security until February 24, 2027, and Laravel 13 until March 17, 2028. Laravel 11 lost security support on March 12, 2026, and every older version is end of life. If you run Laravel 11 or older, plan an upgrade.
Which Laravel versions are supported?
Laravel's support policy gives each major version 18 months of bug fixes and 2 years of security fixes. A new major version ships every year, around the first quarter.
| Version | PHP versions | Released | Bug fixes until | Security fixes until | Status on Nov 3, 2026 |
|---|---|---|---|---|---|
| Laravel 13 | 8.3 to 8.5 | Mar 17, 2026 | Q3 2027 | Mar 17, 2028 | Supported |
| Laravel 12 | 8.2 to 8.5 | Feb 24, 2025 | Aug 13, 2026 | Feb 24, 2027 | Security fixes only |
| Laravel 11 | 8.2 to 8.4 | Mar 12, 2024 | Sep 3, 2025 | Mar 12, 2026 | End of life |
| Laravel 10 | 8.1 to 8.3 | Feb 14, 2023 | Aug 6, 2024 | Feb 4, 2025 | End of life |
| Laravel 9 | 8.0 to 8.2 | Feb 8, 2022 | Aug 8, 2023 | Feb 6, 2024 | End of life |
| Laravel 8 | 7.3 to 8.1 | Sep 8, 2020 | Jul 26, 2022 | Jan 24, 2023 | End of life |
| Laravel 7 | 7.2 to 8.0 | Mar 3, 2020 | Oct 6, 2020 | Mar 3, 2021 | End of life |
| Laravel 6 (LTS) | 7.2 to 8.0 | Sep 3, 2019 | Jan 25, 2022 | Sep 6, 2022 | End of life |
Sources: the support policy tables in the official release notes for Laravel 13, Laravel 10 and Laravel 9, checked on November 3, 2026.
The policy covers the framework. For Laravel's other first-party libraries, the release notes say only the latest major release gets bug fixes.
Why does the PHP version matter too?
Laravel's support depends on PHP being supported as well. An old Laravel version usually means an old PHP version. Laravel 8 and older only run on PHP versions that no longer get security fixes from the PHP project. See which PHP versions are end of life.
How do I check which Laravel version I'm running?
- Run
php artisan --versionin the project folder. It prints something likeLaravel Framework 12.x.x. - Run
composer show laravel/frameworkfor the exact installed version. - Without server access, open
composer.lockin the repository and search for"name": "laravel/framework".
The installed version is what matters, not the constraint in composer.json.
What are the risks of running an unsupported Laravel version?
When a security issue is found in the framework, the fix is released only for supported versions. An end-of-life app stays exposed unless someone backports the patch by hand.
Packages move on too. Newer releases of first-party and third-party packages require newer Laravel and PHP versions, so their security updates stop reaching you as well.
Old Laravel apps also tend to carry old configuration mistakes: APP_DEBUG=true in production, Telescope or Ignition reachable from the internet, or models open to mass assignment. Laravel's own configuration docs say debug mode should always be off in production, because it can expose sensitive configuration values.
How do I upgrade Laravel safely?
- Upgrade PHP first if the next Laravel version needs it. Laravel 13 needs PHP 8.3 or newer.
- Go one major version at a time. Follow the official upgrade guide for each step.
- Update packages in
composer.jsonto versions that support the new Laravel release. - Run your tests after each step. If there are no tests, write a few for login, payments and the main screens before you start.
- Deploy to staging, check the logs, then deploy to production with a rollback ready.
Laravel's release notes describe the move from 12 to 13 as a relatively small upgrade for most apps. Older jumps, such as from Laravel 5 or 6, usually take longer because packages and PHP have to move too.
What if you need help?
Laravel upgrades are routine work for Laravel developers, but an old app with no tests can take a while. Laskyr audits Laravel apps and quotes upgrades at a fixed price after a free 15-minute call. See Laravel security audit and upgrades.
Start with a free read-only scan. It checks your public site for exposed files, debug pages and missing security headers in about 30 seconds.
Read-only scan · No install · Results in about 30 seconds
Questions
Which Laravel versions still get security fixes?
As of November 3, 2026, Laravel 12 and Laravel 13. Laravel 12 gets security fixes until February 24, 2027, and Laravel 13 until March 17, 2028. Laravel 11 and older no longer get security fixes.
How long is a Laravel version supported?
Laravel's support policy gives each major version 18 months of bug fixes and 2 years of security fixes from its release date. A new major version ships every year, around the first quarter.
Is Laravel 11 still supported?
No. Laravel 11 stopped getting security fixes on March 12, 2026. Upgrade to Laravel 12 or 13. Laravel 13 needs PHP 8.3 or newer.
How do I check which Laravel version my app uses?
Run php artisan --version in the project folder. You can also run composer show laravel/framework, or look up laravel/framework in composer.lock.
Can I skip major versions when upgrading Laravel?
It is safer to go one major version at a time and follow the official upgrade guide for each step, running your tests between steps. Several steps can still be done in one project.
Need a hand with this? Laskyr cleans hacked WordPress and PHP sites for a flat $499.
Get help