PHP end-of-life calendar 2026–2028: when each version ends
Every PHP version gets four years of support, and it always ends on December 31. The 2026–2028 dates, what each one means, and what to put on your calendar.
By Jeensuk Yang
PHPFree · Web security · End-of-life calendar
?Who this is for
- You've heard "PHP 8.2 ends at the end of the year" but don't know what comes after
- You'd rather put dates on the calendar now than scramble every time it's in the news
- You want to know how many more years your website's PHP version has
!What you'll learn
- The rule for when PHP support ends, and the dates for 2026 to 2028
- The difference between "active support" and "security support"
- What to write on your calendar, when, and under whose name
Your passport has an expiration date printed on it. That's why you renew it early.
An expired passport doesn't make you disappear. But you can't cross a border with it, and finding out at the airport the night before is too late. PHP has expiration dates too. The good news is that they don't arrive at random. There's a fixed rule, and the dates are published years in advance. This article puts them on one calendar page.
What's the rule for when PHP support ends?
Each PHP version gets four years of support after release: two years of bug and security fixes, then two years of security fixes only. The end date is always December 31.
PHP's developers set this rule in 2024. Their release cycle RFC extended support to "2 years of bug fixes, and 2 years of security fixes" and aligned the end dates "with the end of the year, December 31st." Both changes passed without a single "no" vote.1 That makes the dates easy to remember: you only need to know "the end of which year."
This change will extend release cycle to 4 years: 2 years of bug fixes, and 2 years of security fixes. — PHP RFC, "Release cycle update"
Jeensuk's takeFixed dates are good news. It's hard to prepare for what comes out of nowhere, but you can prepare for what's announced in advance.
What ends when, from 2026 through 2028?
The nearest date is December 31, 2026, when PHP 8.2's security support ends. After that, one version ends every December 31.
| Date | What changes | What to do then |
|---|---|---|
| Dec 31, 2025 (past) | PHP 8.1 reached end of life. Its last release was 8.1.34.2 | If you're on 8.1 or older, you're already late. Move this year. |
| Nov 19, 2026 (planned) | PHP 8.6 general release is planned; the schedule may change.3 | Don't jump right away. First check that WordPress and your host support it. |
| Dec 31, 2026 | PHP 8.2's security support ends. PHP 8.4's active support also ends that day, leaving security support only.4 | If you're on 8.2, pick a date now. If you move, go to 8.3 or newer. |
| Dec 31, 2027 | PHP 8.3's security support ends. PHP 8.5 moves to security support only.4 | If you're on 8.3, decide your next version by fall 2027. |
| Dec 31, 2028 | PHP 8.4's security support ends.4 | If you're on 8.4, decide your next version by fall 2028. |
PHP 8.5's security support runs through December 31, 2029.4 PHP 8.6's end dates aren't on the official support table yet, so they're not on this calendar.
Jeensuk's takeThe most important line on this calendar is the top one, marked "past." Past dates don't come back. If you're on 8.1 or older, your deadline isn't the next date; it's today.
What's the difference between active support and security support?
Active support fixes both bugs and security problems; security support fixes security problems only. When security support ends too, the version has reached "end of life."
PHP's own site lists those versions as unsupported branches and says, "you are strongly urged to upgrade to a current version, as using older versions may expose you to security vulnerabilities."2
PHP2Shell this month is a good example. The fixed releases came out only for 8.2 through 8.5, and the advisory said "PHP 8.1 and older no longer receive updates from the PHP project." Because the flaws were so severe, the security team did post "minimal source-backports" for 7.4, 8.0 and 8.1, but those were for people who build PHP themselves, and there's no promise of the same next time.5 End of life doesn't mean your site stops working. It means that when the next hole appears, no official repair is coming.
Jeensuk's takeYou can live at home just fine with an expired passport. The trouble is the day you need to cross a border, which here means the day the next security problem arrives.
How many years does your website's PHP have left?
Once you know your current PHP version, you can count it right away. If you don't know it, check with the 30-second check or your host's dashboard first.
| Your version | Security support ends | What we suggest |
|---|---|---|
| 8.1 or older | Already ended2 | Pick a date to move now. |
| 8.2 | Dec 31, 2026 | Move to 8.3 or newer this year. |
| 8.3 | Dec 31, 2027 | Fine for now. Choose your next version in fall 2027. |
| 8.4 | Dec 31, 2028 | You have room. Look again in fall 2028. |
| 8.5 | Dec 31, 2029 | The longest runway. |
US hosts are already acting on these dates. Bluehost lists PHP 7.3 through 8.1 as deprecated and supports 8.2 and above.6 DreamHost "recommends at least PHP 8.4."7 WP Engine currently offers 7.4, 8.2 and 8.4, with "a temporary period of extended support" for 7.4, and it upgrades sites automatically when a version reaches end of life.8 Kinsta does the same.9
On the WordPress side, the latest version (7.1) lists PHP 7.4 through 8.5 as supported,10 and the recommended version is 8.3 or greater.11 As of October 25, 2026, WordPress.org's statistics show 34.2% of WordPress sites on 8.1 or older and 23.3% on 8.2.12
Jeensuk's takeA long runway doesn't mean you can forget about it. It means you don't have to rush. "Room to spare" and "forgotten" are two different things.
How should you use this calendar?
Write one date and one name on your company calendar: "In the fall of the year our version ends, [name] checks our PHP version."
"Someday" rarely comes. A task with a when, a who and a what, like "first Monday in October, ask our developer which PHP version we're on," actually happens. In December, your host and your developer are both busy, so fall is the right season.
- Know your version: find out which PHP version your site runs. If you don't know, start with the 30-second check.
- Write the date: find the year your version ends in the table above, and put a date that fall on the calendar.
- Write the name: decide who checks: you, someone on staff, or your developer.
- Read the notices: when your host emails about PHP versions, sort out how urgent it is. Our guide to reading those emails is coming soon in English.
Jeensuk's takeA date on the calendar is a promise. You don't write it down so you'll remember; you write it down so you can safely forget.
Frequently asked questions about PHP end-of-life dates
Will my website stop working when support ends?
No. Your site keeps running. But when a new security problem appears, no official fix will come out, so it's safer to move before the date.
I'm on PHP 8.2. Do I need to switch right now?
We recommend switching this year. Security support ends December 31, 2026, so if you move, set a date to go to 8.3 or newer.
Should I upgrade to PHP 8.6 as soon as it's out?
There's no need to rush. First check that WordPress and your host support it; until then, 8.3 through 8.5 are all still supported.
SOURCES
- PHP RFC, "Release cycle update" (accepted April 2024) wiki.php.net
- PHP Group, "Unsupported Branches" php.net
- PHP wiki, "PHP 8.6 release schedule" wiki.php.net
- PHP Group, "Supported Versions" php.net
- PHP Group, "Security advisory: Critical remote code execution vulnerabilities, update now" (Oct 21, 2026) php.net
- Bluehost, "Changing PHP and WordPress Version" (updated Sep 3, 2026) bluehost.com
- DreamHost, "Upgrading your WordPress site to the latest PHP version" (updated Jul 16, 2026) help.dreamhost.com
- WP Engine, "PHP Upgrade Guide" (updated Jul 12, 2026) wpengine.com
- Kinsta Docs, "Restart and Update PHP" (updated May 28, 2026) kinsta.com
- WordPress Core Handbook, "PHP Compatibility and WordPress Versions" (updated Aug 19, 2026) make.wordpress.org
- WordPress.org, "Requirements" (updated May 7, 2026) wordpress.org
- WordPress.org, "PHP versions" statistics (checked Oct 25, 2026) api.wordpress.org
Once your dates are on the calendar, the next steps continue here. More English editions are on the way.
- Is your business website affected? A one-minute PHP check (coming soon)
- Got a PHP email from your web host? How to read it (coming soon)
- PHP end-of-life calendar 2026–2028 (this article)
- Where to check and change your PHP version, host by host (coming soon)
To understand what went wrong, start with risk series part 1, "What is PHP2Shell?" More articles on the ATATAKAI Digital blog.
How many years does your version have? Find out in 30 seconds.
Enter your site address and we'll tell you right away whether it runs on PHP and where your host stands. If you're not affected, we'll say so plainly: "No need to move right now."
Run the free 30-second checkWant to talk it through after you see the result? Contact ATATAKAI Digital
Updated Oct 26, 2026
