PHP version support
Which PHP branches still receive releases from the PHP project, and which have reached end of life. Support status decides where an upstream security fix will come from.
PHP 8.2 reaches end of life on 31 Dec 2026
After that date the PHP project will publish no further PHP 8.2 releases, including security fixes. If an application cannot move to a newer branch easily, a legacy compatibility assessment sets out what the migration involves before the deadline.
Supported branches
Each branch gets two years of active support from its first release, then two further years of fixes for critical security issues only.
| Branch | Status | First released | Active support until | Security fixes until |
|---|---|---|---|---|
| PHP 8.5 | Active support | 20 Nov 2025 | 31 Dec 2027 | 31 Dec 2029 |
| PHP 8.4 | Active support | 21 Nov 2024 | 31 Dec 2026 | 31 Dec 2028 |
| PHP 8.3 | Security fixes only | 23 Nov 2023 | 31 Dec 2025 | 31 Dec 2027 |
| PHP 8.2 | Security fixes only | 8 Dec 2022 | 31 Dec 2024 | 31 Dec 2026 |
- Active support
- Reported bugs and security issues are fixed in regular point releases.
- Security fixes only
- Only critical security issues are fixed, in releases made as needed. There may be several releases in a year, or none.
End-of-life branches
The PHP project no longer publishes any releases for these branches.
| Branch | End of life | Last upstream release |
|---|---|---|
| PHP 8.1 | 31 Dec 2025 | 8.1.34 |
| PHP 8.0 | 26 Nov 2023 | 8.0.30 |
| PHP 7.4 | 28 Nov 2022 | 7.4.33 |
| PHP 7.3 | 6 Dec 2021 | 7.3.33 |
| PHP 7.2 | 30 Nov 2020 | 7.2.34 |
| PHP 7.1 | 1 Dec 2019 | 7.1.33 |
| PHP 7.0 | 10 Jan 2019 | 7.0.33 |
| PHP 5.6 | 31 Dec 2018 | 5.6.40 |
End of life does not always mean no fix
Distributions and LTS vendors often keep an older branch patched in their own packages, under their own version numbers. For PHP2Shell, the PHP security team also published minimal source backports for PHP 7.4, 8.0 and 8.1. See the PHP2Shell advisory.
A vendor backport buys time. It does not bring a branch back into upstream support, and the next vulnerability may not get one. An end-of-life runtime still needs a migration plan.
Which version is your site running?
The version printed by php -v belongs to the command-line binary. A server can have several PHP versions installed, and each site can be served by a different PHP-FPM pool or web server module. To know which branch matters, find the runtime that serves the site’s web requests.
If a site is on a distribution package, the version number alone will not tell you whether a fix is included. Check the vendor’s security advisory for that package.
The PHP response assessment records the serving runtime, its package source and its patch status for each site.
Sources
Reviewed 22 October 2026.
- Supported versionswww.php.net
- Unsupported brancheswww.php.net