PHP 8.2 Security Fixes End on 31 December 2026

On 21 October 2026, the PHP project published the PHP 8.2.35 announcement. It states: "PHP 8.2 reaches end of life on 31 December 2026 and will receive no further security fixes after that date. Please plan your upgrade to a supported version." If your website or web app runs on PHP 8.2, this is the date to plan around.

I help you plan that upgrade while the date is still ahead of you. The Able Retainer is $799 a month for eight hours of senior production time, planned with you. Reach me at greg@ableadmins.com, or see the Able Retainer.

What this means for your website

PHP is the language your site may be running on the server, even if you have never seen the name. You rarely see it. The server runs it, and the site depends on it. End of life means the people who maintain PHP stop publishing security fixes for that version.

PHP Magazine reported on 30 October 2026 that after 31 December 2026 the PHP project will no longer provide security fixes for the 8.2 branch. That includes vulnerabilities discovered after the cutoff. The article said teams still on 8.2 should make a migration plan, rather than wait until the end of December. A migration plan is a short written path from today's version to a version that still has support.

I keep the detailed lists on the source pages. The announcement is in the PHP project archive for 2026. The dates below come from PHP Magazine's migration guide.

As of PHP Magazine's 30 October report, PHP 8.2 is still receiving security support. The end-of-life date is 31 December 2026. There is time to choose a version, test the site, and move. The calm path is to do that work before the last week of the year. Ask your host which PHP version the public site uses, and keep the answer beside this date.

Choosing a version you can stay on

As of 30 October 2026, PHP Magazine said PHP 8.2 and PHP 8.3 receive security support, while PHP 8.4 and PHP 8.5 remain in active support. Security support means the branch still gets security fixes. Active support is the earlier phase, before a branch is limited to those fixes.

The same article put these dates on the calendar:

PHP 8.3 receives security support until 31 December 2027.
PHP 8.4 remains in active support until the end of 2028.
PHP 8.5 remains in active support until the end of 2029.

PHP Magazine described PHP 8.5 as an attractive target for most applications, because the support window is longer. It described PHP 8.4 as a practical intermediate step when a framework or an extension is not ready for 8.5. A framework is the foundation your site is built on. An extension is an add-on the server loads so a feature can work.

PHP 8.6 is still in release candidates. A release candidate is a test build shared before the stable release. PHP Magazine said it is not a stable production release, so it should not be the production target only because it is the newest build available for testing. Write down 8.5, or 8.4 if you need that intermediate step, and use the written choice as the goal for the live site.

Checks you can do this week

You can start without reading code. A few questions show whether the December date applies to your site, and what a safe test looks like.

Ask which PHP version the live site uses. A copy on a laptop can show a different number.
Ask for a staging site. Staging is a private copy where the new PHP version can be tried before customers see it.
List the features the business relies on: forms, checkout, logins, search, and anything custom.
Ask your host how a PHP change is scheduled and how much notice they need.
Match the target to the magazine's guidance: 8.5 for the longer window, or 8.4 when a framework or extension is not ready for 8.5.

From your side, the aim is a site that feels the same to a customer. Pages load, forms send, and checkout still completes. Underneath, the server is on a branch that still receives support. Bring the answers from the list to one working session. I schedule that time through the Able Retainer.

How Able can help

On the Able Retainer, those hours go into the upgrade with you. The plan is $799 a month, which covers eight hours of senior production time. We confirm the version you run, agree on 8.5 or on 8.4 as the intermediate step, test on a copy, and move the live site when you are happy with the test. I do the server work. You keep the decisions. Email me at greg@ableadmins.com and we will pick a start week that suits your shop or office.

Sources

If your site is still on PHP 8.2, I would like to plan the upgrade with you. Start at the Able Retainer, or email greg@ableadmins.com.