Which PHP Versions Are End of Life? (And What to Do)

As of November 3, 2026, PHP 8.1 and every older version are end of life and get no security fixes from the PHP project. PHP 8.2 and 8.3 get security fixes only, and 8.2's support ends on December 31, 2026. PHP 8.4 and 8.5 are fully supported. If your site runs anything older than 8.2, upgrade it.

Which PHP versions are still supported?

Each PHP branch gets two years of active support (bug and security fixes), then two years of security fixes only. After that it is end of life.

Branch	First released	Active support until	Security support until	Status on Nov 3, 2026
PHP 8.5	Nov 20, 2025	Dec 31, 2027	Dec 31, 2029	Active support
PHP 8.4	Nov 21, 2024	Dec 31, 2026	Dec 31, 2028	Active support
PHP 8.3	Nov 23, 2023	Dec 31, 2025	Dec 31, 2027	Security fixes only
PHP 8.2	Dec 8, 2022	Dec 31, 2024	Dec 31, 2026	Security fixes only, ends in under two months

Source: php.net supported versions, checked on November 3, 2026.

Which PHP versions are end of life?

These branches no longer get any fixes from the PHP project.

Branch	End of life	Last release
PHP 8.1	Dec 31, 2025	8.1.34
PHP 8.0	Nov 26, 2023	8.0.30
PHP 7.4	Nov 28, 2022	7.4.33
PHP 7.3	Dec 6, 2021	7.3.33
PHP 7.2	Nov 30, 2020	7.2.34
PHP 7.1	Dec 1, 2019	7.1.33
PHP 7.0	Jan 10, 2019	7.0.33
PHP 5.6	Dec 31, 2018	5.6.40

PHP 5.5 and older are also end of life. Source: php.net unsupported branches, checked on November 3, 2026.

What are the risks of running end-of-life PHP?

The PHP project stops releasing fixes, so any new security hole in PHP itself stays open on your server. Some Linux distributions and hosts backport fixes into their own PHP packages for a while, but that depends entirely on your provider. Ask them directly.

The bigger problem is usually everything around PHP. Composer packages, WordPress plugins and frameworks drop old PHP versions. Once that happens you cannot install their security updates either, and the app slowly falls behind on every layer.

An old PHP version on a public site is also easy to spot from outside. It tells an attacker the rest of the stack is probably out of date too.

How do I check which PHP version my site runs?

• Hosting control panel. cPanel, Plesk and most managed hosts show the PHP version per site.
• Command line. Run php -v over SSH. The command-line PHP can be a different version from the one serving your website.
• phpinfo(). Create a file containing <?php phpinfo(); in the web root, open it in a browser, note the version, and delete it immediately. Leaving it online exposes your configuration.
• HTTP headers. Some servers send an X-Powered-By: PHP/8.x header. Many hide it, so a missing header proves nothing.

How do I upgrade to a supported PHP version?

1. Pick a target. PHP 8.4 or 8.5. Check that your framework, CMS and plugins support it first.
2. Read the migration guides for each version you skip, for example 8.3 to 8.4 and 8.4 to 8.5. They list removed features and changed behaviour.
3. Scan the code. PHPCompatibility flags code that will break, and Rector can rewrite much of it automatically.
4. Update Composer dependencies to versions that support the new PHP.
5. Test on a copy of the site, not production. Watch the error log for deprecation warnings.
6. Switch production, keep the old version available for a quick rollback, and watch the logs for a few days.

Going from PHP 7 to PHP 8 is the hardest jump, because PHP 8 turned many old warnings into errors. Going from 8.2 to 8.4 or 8.5 is usually much smaller.

What if the upgrade is too big to do yourself?

Old custom PHP apps often need a few rounds of fixes before they run on a supported version. Laskyr audits PHP apps and does the upgrade for a fixed price agreed after a free 15-minute call. See PHP security audit and fixes.

Start with a free read-only scan of your public site. It checks for exposed files, spam injection and missing security headers in about 30 seconds.

Site URL Scan my site free

Read-only scan · No install · Results in about 30 seconds