PHP security support explained: active support, security fixes and end of life
Short answer
Each PHP version goes through three phases. Active support, two years: bugs and security issues are fixed in regular releases. Security fixes only, two more years: releases only for critical security issues, “on an as-needed basis”. Then end of life: no fixes at all. October 2026 shows what that means: PHP 8.2, in its security phase, got 8.2.35 with the PHP2Shell fixes; PHP 8.1, past its end of life, got no official release. For a WordPress site, the rule follows: stay on a version that still gets security fixes, and move before its end date.
The three phases, in php.net’s words
From php.net’s supported versions page (php.net):
- Active support: “Each release branch of PHP is fully supported for two years from its initial stable release. During this period, bugs and security issues that have been reported are fixed and are released in regular point releases.”
- Security fixes only: “After this two year period of active support, each branch is then supported for two additional years for critical security issues only. Releases during this period are made on an as-needed basis: there may be multiple point releases, or none, depending on the number of reports.”
- End of life: “Once the four years of support are completed, the branch reaches its end of life and is no longer supported.”
Where each version stands (October 2026)
| PHP | Active support until | Security fixes until | Phase now |
|---|---|---|---|
| 8.5 | 31 December 2027 | 31 December 2029 | Active |
| 8.4 | 31 December 2026 | 31 December 2028 | Active |
| 8.3 | 31 December 2025 | 31 December 2027 | Security fixes only |
| 8.2 | 31 December 2024 | 31 December 2026 | Security fixes only, ends soon |
| 8.1 and older | ended | ended | End of life |
Sources: supported versions and unsupported branches on php.net.
The October 2026 example
On 21 October 2026 the PHP project fixed two critical flaws (PHP2Shell). Releases came for every supported branch: 8.5.12 and 8.4.27 (active), 8.3.36 and 8.2.35 (security only). For the end-of-life branches the advisory said: “PHP 8.1 and older no longer receive updates from the PHP project.” (php.net) The PHP team published minimal source backports for 7.4 to 8.1 as an exception, given the severity (what those are).
What it means for a WordPress site
- Be on a version with security fixes: 8.2 until the end of 2026, 8.3 or later after that.
- Install its patches when they come; your host usually does (check the number).
- Move before the end date, with a compatibility check of your plugins and theme first (which version).
Next on the calendar: PHP 8.2’s end of life on 31 December 2026. The move itself: CompatNav, free on wordpress.org, checks your plugins and theme for the version you choose, on your own server.
Key takeaways
- Active support: two years of bug and security fixes in regular releases.
- Security fixes only: two more years, releases only as needed for critical issues.
- End of life: no releases at all, even for critical flaws.
- October 2026: 8.2 (security phase) got a fix; 8.1 (end of life) didn’t.
- Next ends: 8.2 on 31 December 2026, 8.3 on 31 December 2027.
Frequently asked questions
Is a version in “security fixes only” safe to use?
Yes, as long as you install its security releases, as with 8.2.35 in October 2026. Just plan the move before its end date.
What does active support add?
Regular bug fixes. For a WordPress site that mostly matters indirectly: fewer odd bugs in PHP itself. Security is covered in both phases.
Where can I check the dates?
On php.net’s supported versions page, which shows each branch’s dates and a calendar.
Check your own site before you upgrade
CompatNav is a free WordPress plugin. It reads the code of your plugins and themes on your own server and tells you, in plain words, what will break and what will only show notices on the PHP version you choose. It never changes your code. It can’t see problems that only appear while code runs with real data, so a quick check of your site after the upgrade still matters.
Sources
About the code examples: each output is the real output of the code shown, run with the official PHP builds, without a php.ini, with all errors reported and displayed. Only the file path was replaced by a neutral server path.