PHP End of Life — Dates and What To Do
PHP 8.1 reached end of life in November 2025 and PHP 8.2 follows on 31 December 2026. Here's which branches still get security fixes — and your three options when yours stops.
PHP Support Timeline
Dates follow the upstream php.net support schedule. Vendor backports change the picture — see the FAQ below.
What End of Life Actually Means
Each PHP minor version gets about three years of support: active bug fixes first, then security fixes only, then nothing. The moment a branch goes end of life, every vulnerability found after that date is unpatched forever on that branch — including the ones you don't know about yet.
October 2026 made this concrete: CVE-2026-109618 and CVE-2026-109619 were fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35 — and nowhere on 8.1 or older, because upstream doesn't touch dead branches. Sites on EOL PHP have exactly three paths: a vendor backport (if yours ships one), a runtime lock-down that reduces but doesn't remove exposure, or a version upgrade.
It's not just security. Payment gateways, insurers and PCI auditors increasingly ask what PHP version the stack runs; hosting companies drop EOL branches from control panels; and framework releases stop testing against them — so an EOL PHP quietly blocks your framework, plugin and CMS updates too.
Your Three Options
Which one fits depends on the PHP version you're actually running — the £149 check answers that in writing.
Emergency patch — £999
Your app runs a supported branch but sits below the fixed point release for CVE-2026-109618 and CVE-2026-109619.
Same or next working day. We move you to the fixed release (8.5.12, 8.4.27, 8.3.36 or 8.2.35) with a backup, staging test and rollback plan.
DetailsVersion upgrade — from £4,999
Your app runs PHP 8.1 or older — upstream released no fix for the current CVE pair on those branches, and there never will be again.
Compatibility fixes, dependency updates and a staged move to a supported PHP branch, verified on staging before production.
DetailsManaged maintenance — from £299/mo
You want PHP updates to stop being emergencies: every point release applied, tested and reported on a schedule.
A year of patch releases, configuration review and a monthly written report — the planned version upgrade is priced separately.
DetailsDon't Know Your Version?
Most people don't. phpinfo output, hosting control panels, Site Health on WordPress andphp -v over SSH can all report different numbers for the same site.
How to check your PHP version covers the four reliable methods — or the £149 check does it for you and tells you exactly which option applies.
Frequently Asked Questions
Does end of life mean my site breaks?+
No — an EOL PHP keeps running, it just stops receiving security patches. Every vulnerability discovered after EOL stays unpatched forever. For a public-facing site that's a real risk: CVE-2026-109618 and CVE-2026-109619 were fixed only on supported branches, so PHP 8.1 sites can never be patched upstream.
Is PHP 8.2 still supported?+
Until 31 December 2026. Security fixes for 8.2 stop after that date, and the branch already only receives security fixes — no bug fixes. If you're on 8.2 you have roughly two months of support left; the emergency patch brings you to the fixed 8.2.35 release, but plan the upgrade to a supported branch now.
My host backports security fixes. Am I still exposed?+
Possibly. Vendor backports (cPanel, CloudLinux, Ubuntu LTS) cover some CVEs but the list of what each vendor actually backports is what matters, not the word 'supported'. CVE-2026-109618/109619 had no upstream 8.1 fix at all — some vendors ship their own backport, many don't. The £149 check verifies the actual patch level on your server rather than guessing.
Which PHP version should I be on?+
The newest supported branch your application has been tested on. For most sites that's PHP 8.3 or 8.4 today; 8.5 is current upstream. The correct answer depends on your plugins, framework and dependencies — that's exactly what the £149 check determines.
Find Out Where You Stand
£149 gets you the confirmed PHP version, your exposure to the current CVEs, and the recommended next step — in writing.