PHP 8.2 End of Life on 31 December 2026: What It Means and How to Upgrade in Time
Updated 24 October 2026. Verify dates on php.net's supported versions page.
If your website runs PHP 8.2, mark 31 December 2026 in your calendar. That's when PHP 8.2 reaches end of life (EOL): the PHP project stops releasing security fixes for it.
The timing matters more than usual. On 21 October 2026, PHP released emergency fixes for the critical PHP2Shell flaws (explained). PHP 8.2 got a fix (8.2.35). The next time something like this happens, after 31 December, it won't.
What "end of life" means
PHP versions follow a fixed lifecycle:
| Phase | What you get |
|---|---|
| Active support (about 2 years) | Bug fixes and security fixes |
| Security support (about 2 more years) | Security fixes only |
| End of life | Nothing from the PHP project |
PHP 8.2's active support ended on 31 December 2024; it has been on security fixes only since then. From 1 January 2027, it gets nothing.
Your site won't stop working on 1 January. It just becomes increasingly risky: any new vulnerability stays open unless your host or Linux vendor backports a fix themselves.
Why PHP2Shell makes this urgent
PHP2Shell showed how this plays out:
- Critical flaws were found in code dating back to PHP 5.4
- Supported branches (8.2 to 8.5) got official releases the same day
- PHP 7.4 to 8.1 got only minimal source backports; 5.4 to 7.3 got nothing
- CISA advised taking PHP 8.1-or-older systems offline until patched or upgraded
If you're on PHP 8.2 when the next critical bug lands in 2027, you'll be in the same position as PHP 8.1 sites this month.
Which version to upgrade to
| Target | Supported until | Best for |
|---|---|---|
| PHP 8.3 | 31 Dec 2027 | Older plugins or code that isn't ready for 8.4; buys one more year |
| PHP 8.4 | 31 Dec 2028 | Most sites: good compatibility, three years of support |
| PHP 8.5 | 31 Dec 2029 | Newer codebases; check plugin and library support |
| PHP 8.6 | Expected release 19 Nov 2026 | Wait a few months after release for ecosystem support (what's new) |
For most WordPress sites, 8.4 is a sensible target, with 8.3 as a fallback if a critical plugin isn't ready. Upgrading straight from 8.2 to 8.4 is usually fine; test as below.
All dates: PHP supported versions and end-of-life dates.
What usually breaks when moving from 8.2
The jump from 8.2 to 8.3 or 8.4 is much smaller than from 7.x to 8.x. Common issues:
- Deprecation notices (for example implicitly nullable parameter types, deprecated in 8.4) filling logs. Usually not fatal, but fix them
- Old plugins or themes that haven't been updated in years
- Libraries pinned to old versions in custom apps (
composer.jsonconstraints) - Nulled or pirated themes and plugins: replace them anyway; they're a security risk
A simple upgrade plan (before December)
Weeks 1–2: inventory
- List every site and which PHP version it uses (how to check)
- List plugins, themes and custom code; note anything not updated in 12+ months
Weeks 3–4: test
- Create a staging copy
- Switch staging to PHP 8.4 (or 8.3)
- Test forms, checkout, logins, admin pages, page builder editing
- Check error logs and Site Health
Weeks 5–6: fix and switch
- Update or replace problem plugins; fix custom code
- Back up and switch production during a quiet time
- Monitor for a week; keep the rollback option ready
Step-by-step guides: WordPress PHP upgrade and changing PHP in cPanel and Hostinger.
Compliance and business reasons
- Payment security scans: unsupported software is one of the findings that can automatically fail a PCI ASV scan, important if you take card payments on your own server
- Client and partner audits increasingly ask which software versions you run
- India's DPDP Rules expect reasonable security safeguards for personal data (checklist); knowingly running unsupported software is hard to defend
What if you can't upgrade in time?
- Ask your host whether they offer extended security builds (some, like CloudLinux and Ubuntu Pro, backport fixes)
- Put the site behind a WAF
- Reduce exposure: remove unused plugins, restrict admin access
- Set a firm upgrade date in Q1 2027
These are stopgaps, not solutions.
Where we fit
We upgrade business websites in Bangalore and Shivamogga to supported PHP versions with staging tests, plugin fixes and zero-downtime switches, and keep them updated after. See website development.
On PHP 8.2 or older? Get in touch for a free check before the deadline.
Sources
Wbzard Labs
Want this done for your business?
We help founders in Bangalore and Shivamogga launch with a website, social media, SEO and ads that work together. Tell us about your business and get a free launch plan.