PHP 8.2 support ends Dec 31: what to decide now
PHP 8.2 security support ends December 31, 2026. What that means, why new holes keep turning up, where upgrades get stuck, a calendar and three paths.
By Jeensuk Yang
PHPFree · Web security · Risk series 05
?Who this is for
- The PHP2Shell scramble is over and you're catching your breath
- Your business website runs on PHP 8.2 or older
- You want to decide what to do about upgrades that come back every year
!What you'll learn
- What the end of PHP 8.2 support on December 31, 2026 means
- Where upgrading to a newer PHP usually gets stuck
- A calendar to year-end, and three paths a small business can take
Things have calmed down. Now look at the calendar.
Since the October 21 fix, hosts have wrapped up their emergency work and the headlines are fading. But about two months from now, on December 31, 2026, PHP 8.2 reaches the end of its support. Here's why this scramble may be a beginning rather than an end, and what to decide before the year is out.
What changes when PHP 8.2 support ends?
When a new hole is found, there's no official fix. That's the rule as of October 25, 2026.
Each PHP version gets four years of support, and PHP 8.2's security support ends on December 31, 2026. After that, the PHP project says the branch "reaches its end of life and is no longer supported."1
Think of a carmaker's service department that stops taking your model. The car still runs, but when it breaks, they won't fix it.
This time, PHP made an exception and published minimal source patches even for 7.4, 8.0 and 8.1, which were already out of support, "given the severity of these vulnerabilities."2 An exception is just that. There's no promise it will happen again.
Jeensuk's takeWhen the year turns, PHP 8.2 moves to the "no more fixes" side. If you're on 8.2 or older, pick a direction before year-end.
Is unsupported PHP rare?
Not at all. Here's what CybelAngel's analysis and the days right after the fix show.
On October 23, the PHP team announced a separate session-handling bug (CVE-2026-115560). The October 21 releases don't fix it; it will be handled in the next regular release.4 It's small and only affects unusual setups, but it's a fact that another related hole appeared right after a big fix.
Jeensuk's take"Fix it once and you're done" isn't how this works. The baseline is to run a version that still gets fixes.
Why do new holes keep turning up?
Because the tools for finding them have changed. PHP2Shell was found with the help of AI, and Wiz, one of the teams behind the discovery, says frontier AI models "substantially reduced that barrier, turning a longstanding flaw into an exploit."5
A single researcher completed in a week what previously would have taken a world-class team months of work. — Wiz Research, Oct 21, 2026
For defenders, holes being found faster is good news. But attackers can use the same tools. My view is that the older and bigger a piece of software is, the more holes we'll keep seeing in it.
Jeensuk's takeIt's more realistic to treat this as something that will repeat, not a one-time accident, and to plan for it.
Is upgrading to the newest PHP the whole answer?
The idea is right, but in practice it often gets stuck. WordPress recommends PHP 8.3 or newer,6 and PHP itself warns that anyone on an end-of-life version "may be exposed to unpatched security vulnerabilities."1
- Old themes or plugins may not support the new PHP. Kinsta notes that problems come from code using functions or syntax newer PHP no longer supports, and the culprit is "almost always a plugin or an active theme."7 On a site built a few years ago, a PHP upgrade can blank the screen or break some pages.
- So test before touching the live site. WordPress's own steps are: back up, update WordPress, themes and plugins, then check compatibility.8 Kinsta adds: "use a staging environment to test the update first."7
- This comes back almost every year. Every PHP version has an end date, so as long as you have a site, this job keeps returning.1
To be fair: some managed hosts patched old versions too this time. Kinsta, for example, patched PHP 7.4 through 8.5.9 That doesn't make staying on an unsupported version a good plan.
A calendar to year-end
| When | What to do |
|---|---|
| October | Find out your site's PHP version and who manages the server (your host, your team, or your developer) |
| November | If you're on 8.2 or older, test on PHP 8.3 or newer in a staging copy. Check that your theme and plugins work |
| Early December | Switch the live site. Check pages and your contact form |
| December 31 | PHP 8.2 support ends |
Jeensuk's takeTest in November and December won't be a scramble. If you don't have a place to test, decide that first.
So which path should your business take?
There are three. Pick one now, while it's still a choice. Psychologists call our habit of putting off a bigger payoff for today's comfort present bias,10 and "we'll upgrade someday" is a classic case.
If someone in-house can do it and you can make time to test, this is the textbook answer.
An outside team handles version upgrades and security fixes. At least "who fixes it" is settled.
If you have few pages and few updates, you can move to a static site. PHP end-of-life dates and foundation cracks stop mattering.
Jeensuk's takeYou don't have to carry this year-end scramble into next year and the year after. At least once, ask: "Does our website really need PHP?"
Frequently asked questions about the end of PHP 8.2
When does PHP 8.2 support end?
December 31, 2026. After that, the PHP project no longer releases fixes for it, even when new holes are found.
If I'm on managed hosting, won't my host handle it?
Some hosts do more than they have to, but don't count on it. A host patching an old version once doesn't mean the old version is safe to keep.
If I upgrade to PHP 8.3, am I set for good?
No. PHP 8.3's security support ends on December 31, 2027. Every version has an end date, so upgrades come back as long as you have a site.
SOURCES
- PHP Group, "Supported Versions" php.net
- PHP Group, "Security advisory: Critical remote code execution vulnerabilities, update now" (Oct 21, 2026) php.net
- CybelAngel, "2.24M Internet-Facing PHP Hosts, 59% on Versions With No Fix Coming: What We Know About php2shell" (Oct 21, 2026) cybelangel.com
- PHP Group, "Informational advisory: Session upload progress" (Oct 23, 2026) php.net
- Wiz Research, "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet" (Oct 21, 2026) wiz.io
- WordPress.org, "Requirements" (updated May 7, 2026) wordpress.org
- Kinsta, "How to update the PHP version in WordPress" (updated Jun 8, 2026) kinsta.com
- WordPress.org, "Update PHP" (updated Jul 29, 2026) wordpress.org
- Kinsta, "PHP2Shell: How Kinsta protected WordPress sites" (Oct 23, 2026) kinsta.com
- Wikipedia, "Present bias" wikipedia.org
Five articles on what PHP2Shell means for small business websites. More English editions are on the way.
- What is PHP2Shell? What it means for your business website
- Patched, but still not safe? Three cases (coming soon)
- Why PHP sites on a VPS or your own server are still at risk (coming soon)
- What if someone got in before the patch? Three signs (coming soon)
- PHP 8.2 support ends Dec 31: what to decide now (this article)
More articles on the ATATAKAI Digital blog.
Before year-end, at least pick a direction.
Enter your site address and we'll tell you right away whether it runs on PHP and where your host stands. If you're not affected, we'll say so plainly: "No need to move right now."
Run the free 30-second checkWant to talk it through after you see the result? Contact ATATAKAI Digital
Updated Oct 26, 2026
