Security updates for PHP 8.2 end on 31 December 2026, and for PHP 8.1 and older they have already ended (As of 2026-10). We move long-running PHP applications, including those with Smarty templates and jQuery front ends, to PHP 8.4 or 8.5 and test every stage.
PHP versions and end of support: dates from 5.6 to 8.5, with sources
For PHP 8.2, security updates end on 31 December 2026; for PHP 8.1 and older they have already ended (As of 2026-10). The timeline gives the dates from PHP 5.6 to 8.5 with sources, plus the target versions for an update.
- All dates with sources, as of 2026-10
- PHP, Smarty and Slim in production since 2012
Published: 2026-10-26 · As of: 2026-10 · Editorial team Prownex
What the timeline shows and how to read it
PHP 8.1 to 8.5 follow one rule: two years of active support, then two years of security updates only (As of 2026-10). When security updates end, the version has reached end of life and receives no more fixes. That is the case for PHP 8.1 and older. PHP 8.2 follows on 31 December 2026 and PHP 8.3 on 31 December 2027.
For each version, the timeline gives the end of security updates as php.net lists it. Older branches from PHP 5.x to 7.3 ended years ago; their dates are on php.net (opens in a new window). A date in the past describes a state, not a shutdown date: the application keeps running, but newly discovered vulnerabilities get no patch.
To find out which PHP version your web server uses, call the phpinfo() function on a test page, which you delete afterwards. The command php -v shows the version of the command line, which may differ. On shared hosting, the version is shown in the provider's control panel.
Support dates of PHP versions
| Date | Event | Source |
|---|---|---|
| 2018-12-31 | PHP 5.6: end of security updates. | php.net (opens in a new window) |
| 2019-01-10 | PHP 7.0: end of security updates. | php.net (opens in a new window) |
| 2019-12-01 | PHP 7.1: end of security updates. | php.net (opens in a new window) |
| 2020-11-30 | PHP 7.2: end of security updates. | php.net (opens in a new window) |
| 2021-12-06 | PHP 7.3: end of security updates. | php.net (opens in a new window) |
| 2022-11-28 | PHP 7.4: end of security updates. | php.net (opens in a new window) |
| 2023-11-26 | PHP 8.0: end of security updates. | php.net (opens in a new window) |
| 2025-12-31 | PHP 8.1: end of security updates. | php.net (opens in a new window) |
| 2026-11-19 | PHP 8.6: planned release (general availability) according to the PHP wiki. | wiki.php.net (opens in a new window) |
| 2026-12-31 | PHP 8.2: end of security updates. | php.net (opens in a new window) |
| 2027-12-31 | PHP 8.3: end of security updates. | php.net (opens in a new window) |
| 2028-12-31 | PHP 8.4: end of security updates. | php.net (opens in a new window) |
| 2029-12-31 | PHP 8.5: end of security updates. | php.net (opens in a new window) |
What end of support means for operators
Once support has ended, newly discovered security vulnerabilities in PHP stay open. What that means for you depends on the version (As of 2026-10):
- PHP 8.1 and older: There are no more security updates. Until the update, access restrictions and an upstream WAF can reduce the risk, but not remove it.
- PHP 8.2: Security updates end on 31 December 2026. After that, the same applies as for PHP 8.1 and older.
- PHP 8.3: Security updates run until 31 December 2027, one year longer than for PHP 8.2. It is an option as an intermediate target.
- PHP 8.4 and 8.5: Security updates run until 31 December 2028 and until 31 December 2029. For an update today, these two are the candidates for the target version.
The effort of an update depends less on the application itself than on extensions, unmaintained libraries, Smarty, jQuery and the database. A hosting provider's surcharge is a warning sign: it can buy time in the short term, but it does not replace the update.
This is what you should check now:
- Which PHP version do the web server and the command line use?
- Which extensions and libraries does the application use, and are they still maintained?
- Which version of Smarty and jQuery is running, and which database version?
- Are there tests for the critical workflows and a test environment that you can roll back?
- Does your hosting provider already charge a surcharge, or is your version about to be switched off?
Background on Smarty and jQuery is on the page PHP.
How to proceed, depending on your starting point
-
-
Your system runs, but nobody knows it in detail. We record application, database, server and email, assess the risks, recommend the next step in writing and, if you wish, take over operations.
-
We move your Lucee, ColdFusion or PHP application from classic hosting into containers without rewriting it. That lets you rebuild, update and relocate the environment. Security updates for PHP 8.2 end on 31 December 2026 (As of 2026-10).
Have your PHP status checked: fixed scope, fixed price
Legacy review
For companies with a system that nobody knows well any more: before an update, before a migration or when changing service provider.
- Inventory of versions and dependencies
- Map of application, database, server and email
- Risk register covering security, support and knowledge
- Assessment of backups and restores
- Recommendation “stay, upgrade or migrate” with an options matrix that also covers “move into a container” and “expose as an API”
- Effort estimate in days
The price covers one system, meaning one application with its database and its server. We price further systems individually.
What the result contains
A written report with inventory, risk register, recommendation and effort estimate. The report is yours.
Sources
The information comes from the following publications of the projects (as of 2026-10):
- PHP: Supported Versions (opens in a new window) for PHP 8.1 to 8.5 and the rule of two years of active support plus two years of security updates.
- PHP: unsupported branches (opens in a new window) for PHP 7.4, 8.0 and older branches.
- PHP wiki: PHP 8.6 (opens in a new window) for the planned release date.
Questions on PHP versions and end of support
What happens if the update is not finished in time?
The application keeps running. After 31 December 2026, however, PHP 8.2 no longer receives security updates (As of 2026-10), and the risk grows with every vulnerability that becomes known later.
If there is not enough time for the whole update, there are two ways to bridge the gap. An intermediate target such as PHP 8.3 receives security updates until 31 December 2027 (As of 2026-10) and buys you a year. In addition, access can be restricted, a WAF placed in front of the application and administrator access limited to a VPN. This lowers the risk but does not remove it.
Is my host's extended support an alternative to updating?
In the short term it can buy time, but it is not an alternative to the update. It applies only at the host in question and ends at the latest when that version is switched off. It also says nothing about whether your application runs on a newer version.
Saving the surcharge is not the reason to update. The surcharge is a warning sign: your version counts as end-of-life at the host. If you want to move away from classic hosting anyway, see From hosting to containers.
What does the update to PHP 8 cost, and how long does it take?
A reliable figure is only possible once we have looked at your application. Effort and duration depend on its condition, not on its size alone. The deciding factors are the starting version, unmaintained extensions and libraries, Smarty, the database, character encoding and existing tests.
We quote fixed prices for the entry products, here the Legacy review with a PHP 8 inventory. It delivers the effort estimate in working days. After that we send you an offer for the update. It is at a fixed price if the scope is clear, otherwise on a time and materials basis.
Do we have to rewrite our PHP application for PHP 8?
Usually not. If the problem is only the PHP version, we update the application in stages and leave its logic unchanged. A rewrite is rarely worthwhile.
It becomes an option when the framework is no longer maintained, there are no tests and the business rules can be written down. Whether that applies to you is shown by the legacy review, which gives a recommendation and an effort estimate in working days.
In 20 minutes we work out which first step fits your system
You tell us the goal and the current state, and we say openly whether and how we can help. Reply within one working day, no obligation.
Phone (German, Polish, English)
+48 501 250 220
Email
Email
Reachable: Monday to Friday, 9:00 to 17:00 Central European Time; support and emergencies around the clock (24/7)