PHP 8.2 receives critical security fixes only until December 31, 2026, and then reaches end of life. Sites and applications still on 8.2, or on already-unsupported branches, need a tested move to 8.3 or later.
\nPHP’s Supported Versions page says each release branch is fully supported for two years from its initial stable release, then supported for two further years for critical security issues only, after which it reaches end of life. Security-only releases are made as needed, so there may be multiple point releases or none.
\nThe page lists security support for PHP 8.2 until December 31, 2026, for 8.3 until December 31, 2027, for 8.4 until December 31, 2028 and for 8.5 until December 31, 2029. It warns that users of an end-of-life release should upgrade as soon as possible because they may be exposed to unpatched security vulnerabilities. A migration guide is published for each supported branch.
\nFor WordPress sites, WordPress.org recommends that hosts support PHP 8.3 or greater, and notes that PHP 7.4, which WordPress still runs on, has reached its official end of life and may expose a site to security vulnerabilities.
\nUse this for managed hosting, shared servers, containers and build images that run PHP. The currently supported list begins at 8.2, so 8.1 and older branches are already past end of life.
\nDSE recommends finding every site and server still on PHP 8.2 or older and moving each to a supported branch, preferably 8.3 or later as WordPress recommends, before December 31, 2026. For each site, list the PHP version, the plugins, themes and libraries in use and their stated PHP compatibility, then read the migration guides for each branch being crossed. Upgrade a staging copy first, fix deprecations and errors, and schedule production changes with a rollback point.
\nOn each upgraded host, confirm the running version from the server, not only the control panel, and review the PHP error log after typical traffic. Exercise logins, forms, checkout and scheduled tasks on staging before cut-over, and keep a dated record of the version per site.
\nPHP.net — Supported Versions. WordPress.org — Requirements. Reviewed October 18, 2026.
", "content_text": "PHP 8.2 receives critical security fixes only until December 31, 2026, and then reaches end of life. Sites and applications still on 8.2, or on already-unsupported branches, need a tested move to 8.3 or later.\nSource facts\nPHP’s Supported Versions page says each release branch is fully supported for two years from its initial stable release, then supported for two further years for critical security issues only, after which it reaches end of life. Security-only releases are made as needed, so there may be multiple point releases or none.\nThe page lists security support for PHP 8.2 until December 31, 2026, for 8.3 until December 31, 2027, for 8.4 until December 31, 2028 and for 8.5 until December 31, 2029. It warns that users of an end-of-life release should upgrade as soon as possible because they may be exposed to unpatched security vulnerabilities. A migration guide is published for each supported branch.\nFor WordPress sites, WordPress.org recommends that hosts support PHP 8.3 or greater, and notes that PHP 7.4, which WordPress still runs on, has reached its official end of life and may expose a site to security vulnerabilities.\nApplicability\nUse this for managed hosting, shared servers, containers and build images that run PHP. The currently supported list begins at 8.2, so 8.1 and older branches are already past end of life.\nDSE recommendation\nDSE recommends finding every site and server still on PHP 8.2 or older and moving each to a supported branch, preferably 8.3 or later as WordPress recommends, before December 31, 2026. For each site, list the PHP version, the plugins, themes and libraries in use and their stated PHP compatibility, then read the migration guides for each branch being crossed. Upgrade a staging copy first, fix deprecations and errors, and schedule production changes with a rollback point.\nVerification\nOn each upgraded host, confirm the running version from the server, not only the control panel, and review the PHP error log after typical traffic. Exercise logins, forms, checkout and scheduled tasks on staging before cut-over, and keep a dated record of the version per site.\nOfficial references\nPHP.net — Supported Versions. WordPress.org — Requirements. Reviewed October 18, 2026.", "content_markdown": "PHP 8.2 receives critical security fixes only until December 31, 2026, and then reaches end of life. Sites and applications still on 8.2, or on already-unsupported branches, need a tested move to 8.3 or later.\n\n## Source facts\n\nPHP’s [Supported Versions](https://www.php.net/supported-versions.php) page says each release branch is fully supported for two years from its initial stable release, then supported for two further years for critical security issues only, after which it reaches end of life. Security-only releases are made as needed, so there may be multiple point releases or none.\n\nThe page lists security support for PHP 8.2 until December 31, 2026, for 8.3 until December 31, 2027, for 8.4 until December 31, 2028 and for 8.5 until December 31, 2029. It warns that users of an end-of-life release should upgrade as soon as possible because they may be exposed to unpatched security vulnerabilities. A migration guide is published for each supported branch.\n\nFor WordPress sites, [WordPress.org](https://wordpress.org/about/requirements/) recommends that hosts support PHP 8.3 or greater, and notes that PHP 7.4, which WordPress still runs on, has reached its official end of life and may expose a site to security vulnerabilities.\n\n## Applicability\n\nUse this for managed hosting, shared servers, containers and build images that run PHP. The currently supported list begins at 8.2, so 8.1 and older branches are already past end of life.\n\n## DSE recommendation\n\nDSE recommends finding every site and server still on PHP 8.2 or older and moving each to a supported branch, preferably 8.3 or later as WordPress recommends, before December 31, 2026. For each site, list the PHP version, the plugins, themes and libraries in use and their stated PHP compatibility, then read the migration guides for each branch being crossed. Upgrade a staging copy first, fix deprecations and errors, and schedule production changes with a rollback point.\n\n## Verification\n\nOn each upgraded host, confirm the running version from the server, not only the control panel, and review the PHP error log after typical traffic. Exercise logins, forms, checkout and scheduled tasks on staging before cut-over, and keep a dated record of the version per site.\n\n## Official references\n\n[PHP.net — Supported Versions](https://www.php.net/supported-versions.php). [WordPress.org — Requirements](https://wordpress.org/about/requirements/). Reviewed October 18, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/php-8-2-security-support-ends-december-31-2026/", "url": "https://update.dsesecurity.com/updates/php-8-2-security-support-ends-december-31-2026/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-18" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/php-8-2-security-support-ends-december-31-2026/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "PHP 8.2 security support ends December 31, 2026: schedule hosted-site upgrades before the branch goes unpatched", "item": "https://update.dsesecurity.com/updates/php-8-2-security-support-ends-december-31-2026/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/php-8-2-security-support-ends-december-31-2026/#article", "identifier": "https://update.dsesecurity.com/updates/php-8-2-security-support-ends-december-31-2026/", "url": "https://update.dsesecurity.com/updates/php-8-2-security-support-ends-december-31-2026/", "headline": "PHP 8.2 security support ends December 31, 2026: schedule hosted-site upgrades before the branch goes unpatched", "description": "PHP 8.2 receives critical security fixes only until December 31, 2026, and then reaches end of life. Sites and applications still on 8.2, or on…", "abstract": "PHP 8.2 receives critical security fixes only until December 31, 2026, and then reaches end of life. Sites and applications still on 8.2, or on already-unsupported branches, need a tested move to 8.3 or later.", "articleBody": "PHP 8.2 receives critical security fixes only until December 31, 2026, and then reaches end of life. Sites and applications still on 8.2, or on already-unsupported branches, need a tested move to 8.3 or later.\nSource facts\nPHP’s Supported Versions page says each release branch is fully supported for two years from its initial stable release, then supported for two further years for critical security issues only, after which it reaches end of life. Security-only releases are made as needed, so there may be multiple point releases or none.\nThe page lists security support for PHP 8.2 until December 31, 2026, for 8.3 until December 31, 2027, for 8.4 until December 31, 2028 and for 8.5 until December 31, 2029. It warns that users of an end-of-life release should upgrade as soon as possible because they may be exposed to unpatched security vulnerabilities. A migration guide is published for each supported branch.\nFor WordPress sites, WordPress.org recommends that hosts support PHP 8.3 or greater, and notes that PHP 7.4, which WordPress still runs on, has reached its official end of life and may expose a site to security vulnerabilities.\nApplicability\nUse this for managed hosting, shared servers, containers and build images that run PHP. The currently supported list begins at 8.2, so 8.1 and older branches are already past end of life.\nDSE recommendation\nDSE recommends finding every site and server still on PHP 8.2 or older and moving each to a supported branch, preferably 8.3 or later as WordPress recommends, before December 31, 2026. For each site, list the PHP version, the plugins, themes and libraries in use and their stated PHP compatibility, then read the migration guides for each branch being crossed. Upgrade a staging copy first, fix deprecations and errors, and schedule production changes with a rollback point.\nVerification\nOn each upgraded host, confirm the running version from the server, not only the control panel, and review the PHP error log after typical traffic. Exercise logins, forms, checkout and scheduled tasks on staging before cut-over, and keep a dated record of the version per site.\nOfficial references\nPHP.net — Supported Versions. WordPress.org — Requirements. Reviewed October 18, 2026.", "datePublished": "2026-10-18T21:00:03+00:00", "dateModified": "2026-10-18T22:22:06+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/php-8-2-security-support-ends-december-31-2026/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/php-8-2-security-support-ends-december-31-2026/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "PHP 8.2 security support ends December 31, 2026: schedule hosted-site upgrades before the branch goes unpatched" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Advisory priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 336, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "PHP.net — Supported Versions", "url": "https://www.php.net/supported-versions.php" } } ] } }