Run PHP 8.4 or 8.5 if you can. According to php.net, 8.2 gets security fixes only until 31 December 2026, 8.3 until the end of 2027, 8.4 until the end of 2028 and 8.5 until the end of 2029. PHP 8.1 is not on the supported list, so it no longer gets fixes.
The support model
Each PHP branch gets two years of active support, with bug and security fixes in regular releases, followed by two years of security fixes only. That is four years in total. php.net lists the dates in its supported versions table.
| Version | Active support until | Security fixes until |
|---|---|---|
| 8.1 | Ended | Ended, no longer listed |
| 8.2 | 31 Dec 2024 (ended) | 31 Dec 2026 |
| 8.3 | 31 Dec 2025 (ended) | 31 Dec 2027 |
| 8.4 | 31 Dec 2026 | 31 Dec 2028 |
| 8.5 | 31 Dec 2027 | 31 Dec 2029 |
The page does not state in words that 8.1 is end of life, but it is missing from the supported table. The endoflife.date record gives 31 December 2025 as its end. Our earlier post on PHP 7.4 end of life risk shows what a long unsupported tail looks like.
Which one fits you
- New project or flexible hosting: 8.5, for the longest runway.
- Established application where you want mature library support: 8.4.
- Stuck on 8.2: you have about ten weeks of security fixes left, so schedule the move now.
- On 8.1 or older: treat it as an open item, not a someday task.
Why shared hosting matters
Many sites run PHP chosen by a host, not by the team. Check your control panel for the active version, since the default can lag. Content management systems and plugins add their own minimum versions, so an old plugin may force an old PHP.
Upgrade steps
- Record the current version in every environment. Run
php -vand check the web server's version, which can differ from the command line. - Check Composer. Run
composer outdatedandcomposer why-not php 8.4to see which packages block a newer PHP. - Replace or update blockers. Abandoned packages are the usual cause. Composer marks them as abandoned in its output.
- Run your tests on the target version with all warnings enabled.
- Roll out to staging, then a small share of production traffic.
- Update the version constraint in composer.json so nobody can install on an older one by accident.
Quick check
What is the difference between active support and security support?
Active support gets bug fixes and security fixes. Security support gets security fixes only. After both end, nothing is released.
Is PHP 8.2 safe to use right now?
It still receives security fixes until 31 December 2026, so it is supported today, but only for a short time.
Where Safeguard fits
Safeguard's dependency scanning reads composer.lock and shows which packages constrain your PHP version. Try the free scan.
Sources
Last reviewed: 19 October 2026.
