PHP 8.2 End of Life: What to Do Before December 31
On 31 December 2026, PHP 8.2 reaches the end of its security support. From 1 January 2027, the PHP project will no longer publish fixes for it, no matter how serious a vulnerability turns out to be. The timing could hardly be more relevant: in October 2026, the critical PHP2Shell vulnerabilities showed how quickly attackers move against flaws in the PHP engine itself, and how much depends on being able to install a patch on the day it is released. Applications that stay on PHP 8.2 next year will not have that option. If your websites or applications run on PHP 8.2, or anything older, now is the time to plan the upgrade.
What End of Life Means
Each PHP version receives two years of active support, with bug fixes and security fixes, followed by two years of security-only support. When security support ends, the version is end of life. It continues to work, but newly discovered vulnerabilities are no longer fixed by the PHP project, and over time libraries and frameworks drop support for it as well.
Some organizations can extend this period. Linux distributions with long-term support, such as Debian, Ubuntu, and Red Hat Enterprise Linux, often backport security fixes to the PHP versions they ship, and commercial vendors offer paid extended support. These options can buy time, but they depend on the vendor, may not cover every flaw, and do not solve the growing incompatibility with modern packages.
PHP Support Timeline
As of November 2026, the support status of recent PHP versions is:
- PHP 8.1: end of life since 31 December 2025
- PHP 8.2: security support ends 31 December 2026
- PHP 8.3: security support until 31 December 2027
- PHP 8.4: active support until 31 December 2026, security support until 31 December 2028
- PHP 8.5: active support until 31 December 2027, security support until 31 December 2029
Which Version Should You Upgrade To?
For most applications, the best target is PHP 8.4 or PHP 8.5. Moving to PHP 8.3 is the smallest step, but its security support ends only a year later, which means repeating the exercise in 2027. PHP 8.4 offers security fixes until the end of 2028 and broad compatibility with current libraries, making it a safe, conservative choice. PHP 8.5 provides the longest runway, until the end of 2029, and is a good fit when your dependencies already support it.
The deciding factor is usually your dependencies. Check that your framework, packages, hosting environment, and PHP extensions all support the target version before committing to it.
What It Means for Laravel Applications
For Laravel teams, the PHP upgrade and the framework upgrade are closely linked. Laravel 12 supports PHP 8.2 to 8.5, but its bug-fix period ended on 13 August 2026 and its security fixes end on 24 February 2027. Laravel 13, released in the first quarter of 2026, requires at least PHP 8.3.
In practice, an application that stays on PHP 8.2 is locked into Laravel 12, which itself stops receiving security fixes in February 2027. The most efficient path is usually to upgrade PHP first, to 8.4 or 8.5, and then upgrade the application to Laravel 13. Applications on older Laravel versions may need several framework upgrades, which is a good reason to start early.
What Changes Between PHP 8.2 and Newer Versions
Upgrades within PHP 8 are usually much smoother than the jump from PHP 7, but there are still changes that can affect older code:
- Implicitly nullable parameters are deprecated in PHP 8.4. Parameters declared with a type and a default of null, without an explicit nullable type, now trigger deprecation notices and should be updated.
- Several extensions were unbundled in PHP 8.4. IMAP, OCI8, PDO_OCI, and Pspell moved out of the PHP core to PECL, so applications that rely on them need to install them separately or replace them.
- New deprecations in each release. Deprecations do not break code immediately, but they show up in logs and often become errors in a later major version, so they are worth fixing during the upgrade.
- Third-party packages may require updates. Older package versions may declare that they do not support newer PHP versions, so dependency upgrades are usually part of the work.
The upgrade also brings useful improvements, including typed class constants in PHP 8.3, property hooks and asymmetric visibility in PHP 8.4, and the pipe operator in PHP 8.5, along with performance improvements across releases.
A Step-by-Step Upgrade Plan
- Inventory every environment. List all servers, containers, and sites running PHP, including staging, internal tools, and cron or queue servers, and record each PHP version.
- Check compatibility. Run
composer why-not php 8.4to see which packages block the upgrade, and review the extensions your application uses. - Use automated tools. Static analysis with PHPStan, compatibility checks with PHPCompatibility, and automated refactoring with Rector catch most issues before they reach production.
- Update dependencies. Upgrade your framework and packages to versions that support the target PHP version.
- Test thoroughly. Run your automated tests, then test critical workflows such as payments, integrations, imports, and scheduled jobs in a staging environment running the new version.
- Deploy and monitor. Roll out the new version, restart all PHP processes and workers, and watch error logs and deprecation notices closely for the first days.
If You Cannot Upgrade in Time
Some applications cannot be upgraded before the end of the year, often because of outdated dependencies or custom code that needs significant work. In that case, reduce the risk while the upgrade is in progress: use a distribution or vendor that provides security backports, keep the application behind a web application firewall, restrict access where possible, remove unused features and endpoints, and monitor closely. Treat these measures as temporary and agree on a firm upgrade date.
Frequently Asked Questions
When does PHP 8.2 reach end of life?
PHP 8.2 security support ends on 31 December 2026. After that date, the PHP project will no longer release security fixes for PHP 8.2.
Will my website stop working when PHP 8.2 reaches end of life?
No. The application will continue to run, but it will no longer receive security fixes from the PHP project. Any vulnerability discovered after 31 December 2026 will remain unpatched unless your hosting provider or Linux distribution backports a fix.
Should I upgrade from PHP 8.2 to 8.3, 8.4, or 8.5?
PHP 8.4 or 8.5 is usually the best choice. PHP 8.3 is the smallest step, but its security support ends in December 2027. PHP 8.4 is supported until the end of 2028 and PHP 8.5 until the end of 2029.
Is upgrading from PHP 8.2 to 8.4 difficult?
For well-maintained applications, it is usually manageable. Most work involves updating dependencies, fixing deprecation notices such as implicitly nullable parameters, and replacing any extensions that were removed from the core. Older applications with outdated packages or little test coverage need more time.
Does Laravel support PHP 8.4 and 8.5?
Yes. Laravel 12 supports PHP 8.2 to 8.5, and Laravel 13 supports PHP 8.3 to 8.5. Applications on PHP 8.2 can upgrade PHP first and then move to Laravel 13.
Is PHP 8.2 affected by PHP2Shell?
Yes. PHP2Shell affects PHP 8.2 versions before 8.2.35. A fix was released in October 2026 because PHP 8.2 was still in security support. Vulnerabilities discovered after 31 December 2026 will not receive such fixes.
How long does a PHP upgrade take?
A simple, well-tested application can often be upgraded in a few days. Larger applications with many dependencies, custom extensions, or a required framework upgrade can take several weeks, which is why starting before the deadline matters.
Conclusion
PHP 8.2 reaches end of life on 31 December 2026, and after PHP2Shell the cost of running unsupported PHP is easy to see. The right response is a planned upgrade, ideally to PHP 8.4 or 8.5, coordinated with framework upgrades such as Laravel 13, backed by automated checks and thorough testing. If your applications run on PHP 8.2 or older and you need help assessing the work, upgrading safely, or modernizing a legacy codebase, our team can plan and carry out the upgrade with minimal disruption to your business.