In short: The PHP project releases a new minor version towards the end of November every year, most recently PHP 8.5 on 20 November 2025. According to php.net, each version branch receives two years of active support and then two years of security fixes only, in each case until 31 December. Currently supported are 8.2 to 8.5; PHP 8.2 ends on 31 December 2026. For older branches there are no more official updates, not even against PHP2Shell.
How does the PHP release cycle work?
The basis is a procedure that the PHP project adopted in 2010 in the RFC "Release Process". An RFC is a formal change proposal on which the developers vote. It established an annual rhythm: planning and first alpha versions in early summer, release candidates in autumn, the finished version in November.
Within a year, every new version passes through fixed stages:
- Alpha: new features are built in and tested.
- Feature freeze and beta: no more major new features, bugs are fixed.
- Release candidates: since the 2024 reform four instead of six candidates, without new features.
- General availability (GA): the finished version, for example 8.4.0 on 21 November 2024.
- Patch releases: 8.4.1, 8.4.2 and so on, with fixes but without new features.
Two plus two years: the current support rule
In April 2024 the PHP project voted on the RFC "Release Cycle Update". All sub-proposals were adopted with a two-thirds majority. Since then, according to php.net:
- Active support: two years from the first stable version. Reported bugs and security issues are fixed in regular patch releases.
- Security support: two further years for critical security issues only. Releases appear as needed, that is, several, one or none.
- End of life: after four years support ends, in each case on 31 December.
Previously there was only one year of security fixes after two years of the active phase. The extension applied from PHP 8.2; according to the RFC, PHP 8.1 also received an additional year.
Which PHP versions are currently supported?
As of 25 October 2026, according to php.net:
| Branch | First release | Active support until | Security fixes until | PHP2Shell fix |
|---|---|---|---|---|
| 8.5 | 20 Nov 2025 | 31 Dec 2027 | 31 Dec 2029 | 8.5.12 |
| 8.4 | 21 Nov 2024 | 31 Dec 2026 | 31 Dec 2028 | 8.4.27 |
| 8.3 | 23 Nov 2023 | 31 Dec 2025 | 31 Dec 2027 | 8.3.36 |
| 8.2 | 8 Dec 2022 | 31 Dec 2024 | 31 Dec 2026 | 8.2.35 |
Branches that have already ended, according to the end-of-life overview on php.net:
| Branch | End of support | Last version |
|---|---|---|
| 8.1 | 31 Dec 2025 | 8.1.34 |
| 8.0 | 26 Nov 2023 | 8.0.30 |
| 7.4 | 28 Nov 2022 | 7.4.33 |
| 7.0 | 10 Jan 2019 | 7.0.33 |
| 5.6 | 31 Dec 2018 | 5.6.40 |
How to plan with the cycle
The fixed rhythm makes updates plannable. A practical approach for companies:
# Show the command-line version and the installed FPM services
php -r 'echo PHP_MAJOR_VERSION, ".", PHP_MINOR_VERSION, PHP_EOL;'
ls /usr/sbin/php-fpm* 2>/dev/null
For each server and each application, enter the branch and its end date in your inventory. Plan the switch to the next branch while active support is still running. In the security phase only critical fixes remain, and shortly before the end time gets tight.
Before every switch comes the question of whether your application supports the new version. Check this against the vendor's system requirements, for example on the websites of WordPress, Shopware or TYPO3. What changed between the versions is shown in the overview PHP 8.0 to 8.5.
What the release cycle meant for PHP2Shell
PHP2Shell showed how hard the line between supported and unsupported is. On 21 October 2026, fixes appeared for exactly the four supported branches: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For PHP 8.1 and older there are no official updates, only minimal source backports for 7.4, 8.0 and 8.1. According to the trade press, almost all versions going back to PHP 5.4 are affected. Details are under Which PHP versions are affected?.
PHP 8.2 ends on 31 December 2026. If you have just updated to 8.2.35, you have gained only a few weeks of buffer. Plan the move to 8.4 or 8.5 now.
For legacy systems, distributions with their own backports or commercial long-term offers remain. Whether these cover PHP2Shell must be confirmed in writing by the provider. The trade-offs are described in Long-term support for old PHP versions, and the risks in the guide PHP end of life.
How does PHP SOS help?
- Map versions: We record all PHP branches on your servers with their end dates.
- Plan deadlines: We determine which systems move to which branch and when.
- Migrate: With the migration from PHP 8.1 and older we lift applications to a supported version, tested beforehand.
- Install patches: Within a branch we keep patch releases up to date promptly and document the restart.
Frequently asked questions
How long is a PHP version supported?
According to php.net, four years: two years of active support with bug and security fixes, then two more years for critical security issues only. Since 2024 the end has fallen on 31 December in each case.
When does support for PHP 8.2 end?
On 31 December 2026. PHP 8.2 still received the PHP2Shell fix with version 8.2.35, after which there will be no more official updates. A move to 8.4 or 8.5 should be planned now.
Are there still updates for PHP 8.1?
Not from the PHP project. According to php.net, PHP 8.1 reached its end on 31 December 2025; the last version was 8.1.34. For PHP2Shell there are only minimal source backports; commercial long-term offers must confirm their coverage in writing.
What is the difference between 8.4 and 8.4.27?
8.4 is the version branch with its language features. 8.4.27 is a patch release within that branch with bug or security fixes but without new features. For security, the last number counts.