Basics
PHP 8.2 end of life: what SMEs need to do by the end of 2026
By Dominik Natter · Last updated on 3 November 2026 · 8 min read
In short
PHP 8.2 reaches end of life on 31 December 2026. After that date, the PHP project no longer fixes security vulnerabilities in this version. SMEs should upgrade to PHP 8.4 or 8.5 by 31 December 2026, which receive security updates until the end of 2028 and the end of 2029 respectively. If you cannot make it in time, you need paid extended support as a bridge or a plan to replace the application.
PHP 8.2 end of life: What does it mean in practice?
From 1 January 2027, the PHP project will publish no further updates for version 8.2. Your website or application will keep running. Newly discovered security vulnerabilities, however, will stay open. That is the real risk of running an outdated PHP version.
October 2026 showed how quickly this becomes a problem. On 21 October, the PHP project released a security update for two critical vulnerabilities rated 9.2 out of 10 on the CVSS scale. Both allow attackers to run their own code on the server without logging in. PHP 8.2 still received the fix in version 8.2.35. PHP 8.1 and older no longer received regular updates. The PHP project only published minimal patches that you have to apply yourself. According to php.net, updating is the only safe option.
- Last day of security updates for PHP 8.2
- 31 Dec 2026
- CVSS rating of the two critical vulnerabilities of 21 October 2026
- 9.2 out of 10
- Time between early November and 31 December 2026
- About 8 weeks
- Security updates for PHP 8.5, for PHP 8.4 until the end of 2028
- End of 2029
There are two further practical consequences. Hosting providers may switch off outdated versions, upgrade them automatically or charge extra for keeping them running. And new versions of plugins, extensions and frameworks require a more recent PHP version. If you stay on 8.2, at some point you can no longer install these updates and lose the security fixes they contain.
Who is affected by PHP 8.2 end of life?
Any software running on a server with PHP 8.2 or older is affected. In SMEs, these are typically:
- WordPress websites. WordPress itself recommends PHP 8.3 or newer.
- Online shops built on WooCommerce, Magento or other PHP systems.
- Shopware 5 shops. According to the vendor, Shopware 5 has received no security fixes since the end of July 2024. Here, the PHP version is only part of the problem.
- Custom PHP applications that a provider built years ago and that have barely changed since.
- Applications on older frameworks. Laravel 11 and older no longer receive security fixes. For Symfony, apart from the current release, only the long-term versions 5.4, 6.4 and 7.4 are maintained.
- Intranet tools, order forms and customer portals. Systems that are only reachable from the company network still carry a risk.
Which PHP version are you running? How to find out
You will usually have the answer within minutes. Check each system separately, as a single server can run several PHP versions side by side.
01
WordPress
Under Tools, Site Health, Info, the PHP version is listed in the Server section.
02
Hosting control panel
In Plesk, cPanel or your provider's customer area, you can see the PHP version for each website and usually change it there too.
03
Custom applications
Your provider or IT team can read the version on the server with a single command. Ask for the framework version at the same time.
04
Ask in writing
Request a list from your hosting provider and service providers of all systems with their PHP version and the date of the last update.
Which PHP version should you upgrade to?
For most SMEs, PHP 8.4 or 8.5 is the right choice. PHP 8.4 receives security updates until 31 December 2028, PHP 8.5 until 31 December 2029. PHP 8.4 has been available since November 2024, PHP 8.5 since November 2025. Both are supported by current releases of common systems.
PHP 8.3 is only a stopgap. Its security updates end at the end of 2027. If you move to 8.3, you will face the same question again at the end of 2027.
PHP 8.6 is planned for 19 November 2026. Hold off on using it in production until the first bugfix releases are out and your plugins and frameworks explicitly support 8.6. That is too tight for a switch by 31 December 2026.
As a rule of thumb, choose the newest version that all your components officially support.
PHP versions and their end of support
31 December 2025
PHP 8.1 and older: no longer supported
Support for PHP 8.1 ended on 31 December 2025. Older versions are no longer maintained either.
19 November 2026
PHP 8.6: release planned
Not yet released. Too tight for a switch by the end of 2026.
31 December 2026
PHP 8.2: end of security updates
Upgrade now.
31 December 2027
PHP 8.3: end of security updates
Stopgap only.
31 December 2028
PHP 8.4: end of security updates
Recommended. Available since November 2024.
31 December 2029
PHP 8.5: end of security updates
Recommended. Available since November 2025.
What typically holds up a PHP upgrade
Changing the PHP version itself is often just a setting at your hosting provider. It becomes costly when the software does not cooperate. These are the most common causes of delay:
- Outdated dependencies: plugins, extensions or libraries that nobody maintains any more and that do not run on newer PHP versions.
- Old frameworks: an application on Laravel 8 or Symfony 4 first has to be upgraded across several major versions.
- Deprecated features: PHP marks features as deprecated before changing or removing them. Custom software has to be adapted in those places.
- Missing tests: without automated tests, someone has to check every function by hand. That takes time and lets errors slip through.
- Missing knowledge: the original developer is no longer available and nobody knows the code.
- Core modifications: customised plugins or changes to the system itself that are lost during an update.
Upgrade, extended support or replace: options and costs
There are three routes. Which one fits depends on the state of the software and how important it is to your business.
Upgrading is the normal case. The figures in the table are indicative values based on typical effort at hourly rates of CHF 150 to 250.
Indicative values for a PHP upgrade
| Starting point | Effort | Cost |
|---|---|---|
| WordPress website with well-maintained plugins | often a few hours | around CHF 500 to 2,000 |
| Custom application on a current framework | more like two to five working days | around CHF 2,500 to 10,000 |
| Framework several major versions behind, no tests | quickly several weeks | CHF 15,000 or more |
Paid extended support buys time. Third-party providers continue to deliver security fixes for a version the PHP project no longer maintains. Zend states that it offers such support for PHP 8.2 until 2028. If you get PHP through a Linux distribution with long-term maintenance, the distributor may provide fixes. Your hosting provider can tell you whether this applies to you.
Replacing makes sense when the application has reached the end of its life anyway: barely documented, dependent on one person, without tests and built on an outdated foundation. Natter Solutions builds new applications with .NET and Next.js rather than PHP, but takes over existing applications after a short fixed-price review and tells you openly whether modernisation is worthwhile or a step-by-step replacement costs less. Read more in our guide "Modernise or rebuild a legacy PHP application? How to decide".
Roadmap: what to do by 31 December 2026
Between early November and 31 December 2026 there are about eight weeks. That is enough for an inventory and the simple cases. For complex applications, you need a plan that extends beyond the turn of the year.
Now
Check the October releases
Check that all systems run at least the October releases 8.2.35, 8.3.36, 8.4.27 or 8.5.12. On PHP 8.1 and older, the critical October 2026 vulnerabilities remain open unless someone applies the PHP project's minimal patches or your hosting provider or distributor has patched them.
By 15 November 2026
List all systems
Create a list of all systems with PHP version, framework and the person responsible.
By 30 November 2026
Agree on responsibilities
Agree with your hosting provider and service providers who upgrades which system, by when and at what cost.
In December 2026
Switch the simple cases
Switch simple cases such as WordPress websites to 8.4 or 8.5. Make a backup first and test on a copy.
By 31 December 2026
Secure the remaining systems
For every system that will not be ready in time, arrange extended support or restrict access, for example to the company network.
From January 2027
Tackle complex applications
Upgrade complex applications in stages or plan the replacement with a preliminary study.
After that
Check once a year
Check the PHP version once a year. PHP 8.3 ends at the end of 2027, PHP 8.4 at the end of 2028. Regular updates belong in a maintenance contract. Read more in our guide "Software maintenance costs: what do maintenance and operations cost per year?".
What you do not need to do
End of life is serious, but it is no reason for rushed decisions.
- You do not need to rebuild everything. For most systems, an upgrade is enough.
- You do not need to move to PHP 8.6. PHP 8.4 and 8.5 are maintained for years to come.
- Hosted services such as Shopify, Microsoft 365 or cloud accounting software do not concern you. The provider is responsible there.
- Software without PHP, such as applications built with .NET, Java or Node.js, is not affected. It has its own support timelines, which you should track separately.
- Static websites without PHP do not need an update.
Where this information comes from
Support dates and security update
The support dates come from php.net, the official website of the PHP project, on its Supported Versions and Unsupported Branches pages. Details of the security update of 21 October 2026 come from the release announcement and the security advisory on php.net. The vulnerabilities are registered as CVE-2026-109618 and CVE-2026-109619. The planned date for PHP 8.6 comes from the release plan in the official PHP wiki.
WordPress, frameworks and extended support
The information on WordPress comes from the requirements page on wordpress.org, on Laravel from its release notes, on Symfony from its releases page and on extended support from Zend's product page. The end of life of Shopware 5 was announced by the vendor Shopware.
Upgrade costs
Upgrade costs are indicative values based on typical effort and do not replace a quote.
As of: November 2026.
| PHP 8.1 and older | No longer supported | 8.1 ended on 31 December 2025 |
|---|---|---|
| PHP 8.2 | Security updates until 31 December 2026 | Upgrade now |
| PHP 8.3 | Security updates until 31 December 2027 | Stopgap only |
| PHP 8.4 | Security updates until 31 December 2028 | Recommended |
| PHP 8.5 | Security updates until 31 December 2029 | Recommended |
| PHP 8.6 | Not yet released | Release planned for 19 November 2026 |
Frequently asked questions
Will my website simply keep running on PHP 8.2 after 31 December 2026?
Technically yes, it will work on 1 January just as before. From then on, however, newly discovered security vulnerabilities in PHP 8.2 will no longer be fixed. Hosting providers may also switch off the old version, upgrade it automatically or charge extra for keeping it running. Ask your hosting provider what they are planning.
Which PHP version should we use in 2027?
PHP 8.4 or 8.5. They receive security updates until the end of 2028 and the end of 2029 respectively, and current releases of common systems support them. PHP 8.3 is only maintained until the end of 2027. With PHP 8.6, wait until the first bugfix releases are out and your plugins officially support it.
How much does a PHP upgrade cost?
As a guideline, a WordPress website with well-maintained plugins costs around CHF 500 to 2,000, a custom application on a current framework around CHF 2,500 to 10,000. If the framework is several major versions behind and there are no tests, CHF 15,000 or more is realistic. What matters is the state of the software, not the PHP version itself.
Can you take over existing software and develop it further?
Yes, after a short review. We look at the code, the data model and how it is operated, and tell you candidly whether further development makes sense or a gradual replacement would cost less. The review takes a few days and is charged at a fixed price.
Who runs the software after go-live?
We do, if you wish. A maintenance contract covers hosting in the EEA, monitoring, security updates, backups and agreed response times. The usual figure is 15 to 20% of the project cost per year. You can also run the software on your own infrastructure or hand it to your IT partner.
Matching services:Custom softwareIntegrations
Let us talk about your case.
20 minutes are enough to find out whether a custom solution is worth it for you.