PHP 8.2 end of life (31 Dec 2026): what WordPress users need to know
Short answer
PHP 8.2 gets security fixes until 31 December 2026, about two months from now. October’s emergency release shows what that means in practice: PHP 8.2 users got the fix for CVE-2026-109618 and CVE-2026-109619 in 8.2.35, while 8.1, already past its end of life, got no official release. After 31 December, PHP 8.2 will be in the same position as 8.1 today. For a WordPress site: make sure you run 8.2.35 or later now, then move to PHP 8.3 or 8.4 before January, after checking your plugins and theme.
The date, and what it means
php.net’s support policy: “After this two year period of active support, each branch is then supported for two additional years for critical security issues only.” And then: “Once the four years of support are completed, the branch reaches its end of life and is no longer supported.” (php.net) For PHP 8.2, released on 8 December 2022, the security period ends on 31 December 2026.
October 2026 shows the difference
When the PHP2Shell flaws were fixed on 21 October 2026, PHP 8.2 was still supported, and got 8.2.35. php.net’s release note for it adds: “PHP 8.2 reaches end of life on 31 December 2026 and will receive no further security fixes after that date. Please plan your upgrade to a supported version.” (php.net)
PHP 8.1 had reached its end of life on 31 December 2025. For it, the same advisory says: “PHP 8.1 and older no longer receive updates from the PHP project.” A comparable flaw found in 2027 would leave PHP 8.2 sites in that position.
What to do now
From 8.2, the check covers few changes: CompatNav runs 4 checks for a move to 8.3, all of them for deprecation notices, and 13 for a move to 8.4, one of which can stop a page. CompatNav is a free plugin on wordpress.org and runs the check on your own server.
More detail
The full picture of PHP 8.2’s end of life, with the changes from 8.2 to each newer version: PHP 8.2 reaches end of life on 31 December 2026. The October release itself: PHP2Shell.
Key takeaways
- PHP 8.2 gets security fixes until 31 December 2026, then none (php.net).
- 8.2.35, released 21 October 2026, fixed CVE-2026-109618 and CVE-2026-109619.
- 8.1 got no official release for the same flaws: that’s what end of life means.
- Nothing switches off on 1 January; what stops is the fixes.
- Next step: PHP 8.3 (fixes until end of 2027) or 8.4 (until end of 2028), checked first.
Frequently asked questions
Will my site stop working on 1 January 2027?
No. The same code keeps running. What ends is the PHP project’s security fixes, so any flaw found afterwards stays open on 8.2, and hosts may move sites to a newer version.
Is PHP 8.2.35 safe right now?
Against CVE-2026-109618 and CVE-2026-109619, yes. Until 31 December, 8.2 still receives fixes for critical issues as needed.
8.3 or 8.4?
8.4 gets fixes a year longer. Check your plugins and theme for both; take the newest one that’s ready.
Check your own site before you upgrade
CompatNav is a free WordPress plugin. It reads the code of your plugins and themes on your own server and tells you, in plain words, what will break and what will only show notices on the PHP version you choose. It never changes your code. It can’t see problems that only appear while code runs with real data, so a quick check of your site after the upgrade still matters.
Sources
About the code examples: each output is the real output of the code shown, run with the official PHP builds, without a php.ini, with all errors reported and displayed. Only the file path was replaced by a neutral server path.