Under PHP's policy, active support means reported bugs and security issues are fixed and regular point releases are made. Security fixes only means the release is supported for critical security issues, with releases made as needed. End of life means no support. Each branch gets two years of active support and then security support until four years after release.
The three states
The PHP supported versions page defines three states with a colour key and a calendar. In its own words, active support is a release that is being actively supported, where reported bugs and security issues are fixed and regular point releases are made. Security fixes only is a release supported for critical security issues only, where releases are made on an as needed basis. End of life is a release that is no longer supported, and the page says users should upgrade as soon as possible because they may be exposed to unpatched security vulnerabilities.
| State | Fixes | Release rhythm |
|---|---|---|
| Active support | Reported bugs and security issues | Regular point releases |
| Security fixes only | Critical security issues | As needed |
| End of life | None | None |
Reading the table
The page lists each branch with its initial release, active support end and security support end. When I viewed it on 19 October 2026 it showed 8.2 with security support until 31 December 2026, 8.3 until 31 December 2027, 8.4 until 31 December 2028 and 8.5 until 31 December 2029. Active support for 8.4 was listed to end on 31 December 2026. Dates move when new branches arrive, so use the live page.
The page also states that a branch is supported for four years in total before it reaches end of life.
Why the middle state matters
Many production teams run a version that is in security fixes only. That is normal and supported, but it has a catch. A bug you hit will not be fixed upstream. Only critical security issues are in scope, and the wording says critical, not every security report. If your application depends on a less common extension, check whether a fix for a lower severity issue would be released at all.
What dependents should do
- Find the PHP version in every container image, hosting plan and CI job.
- Note whether each is in active support or security fixes only.
- Set the upgrade deadline at the security support end date minus one planning cycle.
- For anything in security fixes only, subscribe to release announcements so urgent patches are not missed.
- Check hosting providers: a host may keep an old branch available after upstream stops patching it.
- Test the next branch in CI now. PHP upgrades often expose deprecated features.
A note for library maintainers
If you publish a PHP package, your compatibility table should follow the same states. Tell users which PHP branches you test and which you will fix security issues for.
Quick check
Is security fixes only the same as security support?
They describe the same stage: the release is supported for critical security issues only, with releases as needed.
Can I stay on a security fixes only branch for years?
Until its end of life date, yes, within the limits above. Plan the move before then.
Does my host keep me safe after end of life?
Not by default. Ask the host in writing what it patches and for how long.
How Safeguard helps
Safeguard's asset discovery and continuous monitoring can show which services run which versions, and its SBOM and dependency scanning check those versions against known advisories. Reachability analysis helps you rank what to fix first. Autonomous remediation with fix pull requests is off by default, with every category on Manual. The free scan is a low-effort place to start.
Sources
- PHP Group, Supported Versions: state definitions and the current branch table. Fetched 19 October 2026.
Last reviewed: 19 October 2026.
