Which PHP versions still get security fixes?
If your sites run on an old PHP version, new security holes will not be fixed. Here's where each version stands and what to do.
Short version: use PHP 8.4 or 8.5 for new sites. Plan to move off PHP 8.2 before the end of 2026. PHP 8.1 and older no longer get any fixes.
How PHP support works
Each PHP version gets about two years of active support (bug and security fixes), then two more years of security fixes only. After that it reaches end of life: no more fixes at all, even for serious security problems.
Supported versions (November 2026)
| Version | Status | Security fixes until |
|---|---|---|
| PHP 8.5 | Active support | 31 Dec 2029 |
| PHP 8.4 | Active support (security-only from 2027) | 31 Dec 2028 |
| PHP 8.3 | Security fixes only | 31 Dec 2027 |
| PHP 8.2 | Security fixes only | 31 Dec 2026 |
| PHP 8.1 and older | End of life | No longer fixed |
Always check the official table at php.net/supported-versions before planning — dates can change.
What "end of life" means for your sites
- New vulnerabilities in PHP itself won't be patched by the PHP project.
- Popular apps (WordPress plugins, Laravel, Drupal, Symfony) drop old PHP versions, so you can't update them either.
- Some Linux distributions backport fixes to their own PHP packages for longer — but only for the version they shipped.
How to plan an upgrade
- Find out what you run.
php -von the server, or check your hosting panel. - Check your app. Make sure your CMS, theme and plugins support the newer PHP version.
- Test a copy first. Run the site on the new version in staging and click through the important pages.
- Switch one site at a time. Keep the old version installed so you can switch back quickly.
- Watch the logs for warnings for a few days after the switch.
Running several PHP versions side by side — one per site — makes this much easier. It's one of the things we're building into ServerNest.