PHP 8.2 Loses Security Support December 31: What Website Owners Need to Do
By Ian Mason • October 30, 2026 • Website Design
By Ian Mason • October 30, 2026 • Website Design
By Ian Mason • October 30, 2026 • News, Website Design
Read time: 4 minutes. In short: After December 31, 2026, the PHP project stops publishing security fixes for PHP 8.2. Websites running it will keep working, but the next serious vulnerability won't be patched. If your site runs PHP 8.2 or older, plan an upgrade to PHP 8.3 or newer now, while there's time to test.
Earlier this month, we wrote about PHP2Shell, the critical PHP vulnerability disclosed on October 21. PHP 8.2 was among the versions that received an emergency fix.
That won't happen again after December 31.
Every PHP version follows the same schedule. It gets two years of full support, with bug fixes and security fixes. Then it gets two more years of fixes for critical security issues only. After that, it reaches end of life.
PHP 8.2 was released in December 2022. Its full support ended on December 31, 2024. Its security support ends on December 31, 2026.
After that date:
Your website keeps running. Nothing switches off on January 1.
The PHP project stops releasing security fixes for 8.2.
Any new vulnerability found in PHP 8.2 stays open on sites that haven't upgraded.
PHP2Shell showed how quickly a PHP vulnerability can go from disclosure to an urgent fix. Sites on supported versions had a patch available the same day.
A site still on PHP 8.2 next year wouldn't have that option. If a similar flaw is found in 2027, there's no official patch coming for 8.2.
Hosting companies don't always wait for the deadline, either. Acquia, a major Drupal host, ended its own PHP 8.2 support on October 1, 2026, three months early, so customers would be upgraded before the PHP project stopped patching.
Some hosts and vendors sell extended support for older PHP versions. If yours does, ask what it covers, how quickly patches arrive and when it ends. It can buy time, but it doesn't make PHP 8.2 a supported version again.
| Version | Security support until | Notes |
|---|---|---|
| PHP 8.2 | December 31, 2026 | Ends this year |
| PHP 8.3 | December 31, 2027 | Security fixes only; minimum for Drupal 11 |
| PHP 8.4 | December 31, 2028 | Full support ends December 31, 2026 |
| PHP 8.5 | December 31, 2029 | Newest; full support through 2027 |
PHP 8.3 buys one more year. PHP 8.4 or 8.5 gives you two or three years before you face this again, which usually makes the testing effort worth it.
The platforms are ready. WordPress lists PHP 8.3, 8.4 and 8.5 as compatible with its current releases, and Drupal 11 requires PHP 8.3 or newer. Drupal support depends on your exact release, though, and older Drupal 10 sites may not support the newest PHP versions, so check Drupal's requirements for your version before choosing a target. The real question is usually your theme, plugins or modules, especially older or custom ones.
Our PHP2Shell article walks through finding your PHP version in WordPress. Drupal shows it under Reports, then Status report. Your hosting control panel or hosting company can also tell you.
If the answer is 8.2, 8.1 or anything older, your site needs an upgrade. Versions 8.1 and older already stopped receiving security fixes.
Two more checks:
Check every site you own. Microsites, landing pages, client portals and old subdomains often sit on different hosting accounts and get missed.
Don't rely on your page source. A "generator" tag in your site's code can be missing or outdated. Your admin dashboard, host or developer is the reliable answer.
Changing the PHP version is often a single setting with your host. Doing it safely takes a little more:
Check compatibility. Confirm your theme, plugins, modules and any custom code support the new version. Outdated WordPress or Drupal core may need updating first.
Back up the site. Files and database, with a tested way to restore them.
Test on a copy. A staging site on the new PHP version shows problems before customers do.
Switch the live site. Through your hosting control panel, or by your host or developer.
Retest what matters. Contact forms, checkout, logins, search, anything that sends email, and background tasks like scheduled imports. Problems often show up in rarely used features, not on the homepage.
Watch the error logs. For a few days afterward, check for warnings that point to code that needs attention.
For a simple, well-maintained site, this can be quick. Sites with older plugins or custom code take longer, which is why starting in October beats starting in late December.
PHP 8.2's end of life is the rare security issue with a date on the calendar. That makes it one of the easiest to handle well, as long as someone owns it.
If you're not sure which PHP version your website runs, or who is responsible for upgrading it, contact MOJO. We build and maintain websites on WordPress and Drupal, and we can tell you where yours stands.
Will my website stop working on January 1, 2027?
No. Sites on PHP 8.2 keep running. They just stop receiving security fixes from the PHP project.
Doesn't updating WordPress update PHP?
No. PHP is server software, separate from WordPress, Drupal and their plugins. It's usually managed by your hosting company or website maintenance provider.
Is PHP 8.3 enough?
PHP 8.3 receives security fixes through December 31, 2027. It's a valid choice, but you'll face another upgrade next year. If your site supports 8.4 or 8.5, those last longer.
What if a plugin doesn't support the newer version?
Check for an update first. If the plugin is abandoned, it's usually time to replace it, since it likely isn't getting security updates either.
