PHP End of Life Dates for 7.4, 8.1 and 8.2, and What to Do

Key takeaways

• On 22 October 2026, PHP 7.4, 8.0 and 8.1 have no support. php.net lists their end of life dates as 28 November 2022, 26 November 2023 and 31 December 2025.
• PHP 8.2 is still supported, but not for long. Its security support ends on 31 December 2026, about ten weeks from today.
• PHP 8.3, 8.4 and 8.5 still get support. 8.4 is still in active support to 31 December 2026 and 8.5 to 31 December 2027.
• End of life means no more fixes from the PHP project. The critical flaws from October 2026 got fixes in 8.5.12 (on 8.5), 8.4.27 (on 8.4), 8.3.36 (on 8.3) and 8.2.35 (on 8.2). 8.1 and older received no official fix.
• php.net made a small exception. For 7.4, 8.0 and 8.1 it released small source patches aimed at people compiling PHP themselves. A normal site should not lean on them.
• The cure is the same for everyone. Move to a supported branch at your host, test first, and ask the host to confirm in writing.

What do the support dates mean?

php.net explains the system in two steps. Each branch is fully supported for two years from its first stable release, and during that time reported bugs and security issues are fixed in regular point releases. This is called active support. After that, each branch gets two more years of critical security fixes only, released as needed, and that is called security support.

When the security period ends, the branch is end of life, or EOL. The PHP project stops releasing fixes for it.

Every PHP branch from 7.4 to 8.5

The table below uses the dates as listed by php.net wherever it lists them. A word on sources: when we read the php.net supported versions page on 22 October 2026 it only listed 8.2 to 8.5. The end date for 7.4, 8.0 and 8.1 is on php.net's end of life page, while their release and active support dates are from endoflife.date, also read today. Both sources agree on the security end dates.

So by those dates, three branches are unsupported today: 7.4, 8.0 and 8.1. Kinsta's guide, which cites endoflife.date and was updated on 8 June 2026, paints the same picture.

PHP 7.4 end of life

PHP 7.4 was released on 28 November 2019. Its security support ended on 28 November 2022, and the last release was 7.4.33. That is nearly four years ago.

WordPress cares about 7.4 because WordPress.org lists it as the oldest PHP version WordPress still runs on. That is a statement about compatibility, not safety. A site can run perfectly well on a branch that the PHP project no longer fixes.

PHP 8.1 end of life

Per php.net, security support for PHP 8.1 ran out on 31 December 2025, with 8.1.34 as the final release. If you searched for "PHP 8.1 end of life", this is the date: it passed about ten months ago.

PHP 8.0 is in the same position, with its end date on 26 November 2023.

PHP 8.2 end of life

PHP 8.2 is the one to plan for. It was released on 8 December 2022, active support ended on 31 December 2024, and security support runs to 31 December 2026. After that it is end of life too.

It received the October 2026 fix, in version 8.2.35, so an up to date 8.2 is covered today. The catch is the calendar. If you stay on 8.2, you will need to move again within about ten weeks, so it makes sense to jump to 8.3 or 8.4 while you are already making a change.

What end of life means for a WordPress or PHP site

Three practical things follow.

1. Security fixes stop. When a new flaw is found in an end of life branch, the PHP project does not publish a fix. php.net's own EOL page says unsupported branches may have unfixed security vulnerabilities.
2. The October 2026 flaws show the cost. On 21 October 2026 php.net announced two critical flaws that let an unauthenticated attacker run code remotely. Fixed releases exist for 8.2 to 8.5. For 8.1 and anything older, php.net states that the project ships no updates, though certain Linux distributions and long term support vendors may supply backported fixes. If you are new to the term, see what remote code execution means.
3. Your site may keep working. An end of life PHP version does not break your pages. It simply stops getting protection, which is why the risk is easy to ignore until it is not.

According to Kinsta, close to half of all WordPress sites are still on an end of life PHP version. This is Kinsta's own claim, so take it as a sign of how common the problem is, not as a measured figure.

For the full story of the flaws, read our main PHP vulnerability guide.

Source-only patches for the oldest three branches

The php.net advisory says the PHP security team put small source-code patches for 7.4, 8.0 and 8.1 on GitHub, since the two flaws are so serious. Their audience is anyone compiling PHP by hand, or anyone with no long term support vendor to call.

For most site owners this is not the route. Building PHP from source is a job for a system administrator, and a backport fixes these two flaws only. It does not bring the branch back into support. If you rely on an old version through a vendor, ask them for their patch details.

What to do in your situation

Cannot move yet? php.net names stopgap settings that merely shrink the exposure: memory_limit at -1 so apps cannot override it, a low post_max_size, session.upload_progress.enabled at 0, and fatal_error_backtraces at 0 on PHP 8.5. None of them leave an install safe. The NCSC says that where neither updating nor these settings is possible, you may want to pull the system offline and look for signs of compromise.

How to move to a newer PHP version

The current WordPress.org recommendation is PHP 8.3 or higher, while Kinsta prefers 8.4 as the safer default. Either way the steps do not change:

1. Find your version. Start with the checking and updating PHP on WordPress guide. Other setups are covered in how to check your PHP version in WordPress, cPanel or the command line.
2. Back up the site, then update WordPress, themes and plugins.
3. Try the changes on a staging copy, where your host provides one.
4. Change the version in your host's panel, or ask them to.
5. Check the site, then ask the host in writing to confirm the fix. Use our questions to ask your web host as a checklist.

If your host is slow or only offers old versions, a move may be worth considering. In managed WordPress hosting versus shared hosting we explain who handles patching under each model. Also see the WordPress minimum PHP version for what WordPress itself needs.

Related reading on PHP: upgrading safely from PHP 7.4, PHP 8.3 against 8.4 and 8.5, how to check plugins work with PHP 8.3.

How we help

When a plugin or theme keeps your site stuck on an old PHP version, we treat that as an ordinary fix-up job, and our WordPress development page explains our approach. For ongoing care there is Webflow maintenance, and to leave server software behind entirely, Webflow migration moves a WordPress site and keeps your URLs. We price by scope and never by the hour; the website maintenance cost guide lists typical budget lines. Once the final payment is made, the design, copy and code belong to you, along with the logins for domain, hosting and analytics.

Frequently asked questions

When did PHP 7.4 reach end of life?

php.net lists the end of life date for PHP 7.4 as 28 November 2022, and the last release was 7.4.33. It has had no official security fixes since.

When does PHP 8.1 reach end of life?

php.net lists 31 December 2025 as the end of life date for PHP 8.1, with 8.1.34 as the last release. That date has already passed, so 8.1 is unsupported today.

When does PHP 8.2 reach end of life?

Security support for PHP 8.2 ends on 31 December 2026, per php.net. As of 22 October 2026 it is still supported, and 8.2.35 carries the fix for the October flaws. Aim to be on 8.3 or 8.4 by then.

Is PHP 8.0 also end of life?

Yes. php.net lists 26 November 2023 as its end of life date, with 8.0.30 as the last release. It is unsupported today.

Is it safe to stay on PHP 8.1 if my host patches it?

It depends on the host. php.net says some distributions and long term support vendors may provide backported fixes. Ask your host in writing exactly what they patch and until when. Since a backport may leave the old version number in place, the number by itself proves nothing.

Will my WordPress site stop working on an old PHP version?

No. WordPress.org lists 7.4 as the oldest PHP it still works with. The risk is not that the site breaks. It is that the PHP underneath no longer receives fixes from the PHP project.

Which PHP version should I choose now?

WordPress.org recommends 8.3 or higher, and Kinsta recommends 8.4. Whichever you pick, test first and use the fixed patch level. Treat this as general guidance only: no guarantee, and no legal advice.