PHP 8.2 End of Life Date: December 31, 2026 — What You Need to Know
PHP 8.2 is currently in security-only support. Active support ended December 8, 2024. You are receiving critical CVE patches only until December 31, 2026 — after which PHP 8.2 receives nothing. If your application depends on PHP 8.2, migration or an extended support contract needs to start now.
Key Dates at a Glance
- PHP 8.4: active support ends 2026-12-31; end of life 2028-12-31
- PHP 8.3: active support ends 2025-12-31; end of life 2027-12-31
- PHP 8.2: active support ends 2024-12-31; end of life 2026-12-31
- PHP 8.1: active support ends 2023-11-25; end of life 2025-12-31
- PHP 7.4: active support ends 2021-11-28; end of life 2022-11-28
PHP 8.2 lifecycle dates
| Phase | Date | Status |
|---|---|---|
| Initial release | November 8, 2022 | Released |
| Active support ends | December 8, 2024 | Passed |
| Security support ends (EOL) | December 31, 2026 | Upcoming |
Is PHP 8.2 still supported?
PHP 8.2 is still receiving security patches in 2026 — but only security patches. The PHP project entered security-only maintenance on December 8, 2024. This means:
- No new features or improvements
- No bug fixes unless they are also security vulnerabilities
- Only CVEs rated high or critical by the PHP security team receive patches
- All support ends completely on December 31, 2026
For most production environments, being on security-only support is acceptable — but the hard deadline of December 31, 2026 means migration work needs to begin in mid-2026 at the latest.
What PHP version should you migrate to?
PHP 8.3 is the primary recommended migration target. Active support runs until December 2026, with security support extending to December 31, 2027. Migration from PHP 8.2 to 8.3 is typically low-friction — no major breaking changes affect most applications.
PHP 8.4, released November 2024, is also a valid target if you want to stay current longer. Active support runs to November 2026, with security support through November 30, 2027.
Avoid migrating to PHP 8.1 — it reached end of life on December 31, 2025 and is already unsupported.
Which vendors offer extended support for PHP 8.2 after EOL?
If migration cannot be completed before December 31, 2026, commercial vendors offer extended CVE patching and compliance coverage:
Third-Party ELS Vendors
Extended Lifecycle SupportSpecialist ELS vendors provide continued CVE patching for PHP after official EOL — typically covering PHP 8.2, 8.1, 7.4, and earlier versions. Multi-year contracts available, commonly at a CVSS 7+ threshold.
View via endoflife.ai →Check your PHP exposure alongside other EOL components
See the full CVE risk profile for PHP 8.2 and every other EOL component in your stack.
PHP 8.2 Risk Score →PHP currently carries an EOL Risk Score™ of 80/100 — Grade D, high risk, recalculated at every site build from EOL recency, attack surface, CISA KEV exposure, and extended-support availability. Per-version scores and dates are on the PHP lifecycle page.
The right response comes down to one question: how many more years does this system need to run? Under a year, extended support (where it exists) is usually cheaper than an emergency migration. One to three years, migrate — support fees paid repeatedly cost more than doing the project once. Indefinitely, migrate now and plan the next one before it surprises you. Extended support is often the more expensive choice over a multi-year horizon — a bridge, not a destination. And if this deadline feels like vendor caprice, it isn’t — why end of life is inevitable for every version, with the receipts.
What PHP 8.2 end of life means for Laravel applications
Laravel applications are one of the largest PHP 8.2 populations. Whether the December 31, 2026 deadline forces a framework upgrade or just a PHP bump depends entirely on which Laravel major you run — the framework’s own support windows (verified against laravel.com) are:
| Laravel version | Supported PHP | Framework security fixes | Your move before PHP 8.2 EOL |
|---|---|---|---|
| Laravel 13 | PHP 8.3 – 8.5 | Laravel 13: security fixes until 2028-03-17 | Nothing — Laravel 13 cannot run on PHP 8.2, so you are already clear. |
| Laravel 12 | PHP 8.2 – 8.5 | Laravel 12: security fixes until 2027-02-24 | Upgrade PHP in place to 8.3, 8.4 or 8.5 — no framework jump needed. This is the cheapest exit anyone gets from PHP 8.2. |
| Laravel 11 | PHP 8.2 – 8.4 | Laravel 11: security fixes ended 2026-03-12 | The framework is already end of life. On PHP 8.2 you face double exposure after March 12, 2026 — an unpatched framework on an unpatched runtime. Move to Laravel 12 or 13. |
| Laravel 10 and older | PHP 8.1 – 8.3 (max) | Laravel 10: security fixes ended 2025-02-04 | Same double exposure, longer upgrade path. If the app cannot be upgraded this year, extended support for the PHP runtime is the stopgap while you plan the framework migration. |
The practical takeaway: Laravel 12 users on PHP 8.2 have a one-day fix (bump the runtime to PHP 8.3+ — Laravel 12 supports it natively), while Laravel 11-and-older apps pinned to PHP 8.2 carry compounding risk on two layers at once. Check where every one of your apps stands on the Laravel lifecycle page.
Frequently asked questions
The Monthly EOL Digest™
Once a month — critical EOL dates, CVE blind spots, and lifecycle changes worth knowing about.