PHP 8.2 stops receiving security fixes on 31 December 2026, so any website still running it should plan its move to a supported PHP version now. Here is how to check your site, why the upgrade often includes your CMS, and what to do first.
| Key fact | PHP 8.2 end of life |
|---|---|
| What | PHP 8.2, a version of the programming language most websites run on, stops receiving security fixes from PHP. |
| When | 31 December 2026. |
| Affected | Any website whose server runs PHP 8.2, including WordPress, Drupal, Magento, Silverstripe and custom sites. |
| Still supported | PHP 8.3 (to 31 December 2027), 8.4 (to 31 December 2028) and 8.5 (to 31 December 2029). |
| Already unsupported | PHP 8.1 and older. PHP 8.1 ended on 31 December 2025. |
| Move to | The newest supported PHP version your CMS version runs on. For most sites, 8.4 or 8.3. |
| Do now | Find out which PHP version your website runs, and plan the upgrade. |
Checked 22 October 2026 against php.net, the CMS projects' own documentation and endoflife.date. Sources are listed at the end.
What happens on 31 December 2026?
PHP is the programming language behind WordPress, Drupal, Magento, Silverstripe and many custom web applications. Every website built on one of those runs on a particular PHP version, chosen on the server.
Each PHP version has a fixed support period. PHP says each version is "fully supported for two years from its initial stable release", then "supported for two additional years for critical security issues only."
PHP 8.2 was released on 8 December 2022. Its full support (bug fixes as well as security fixes) ended on 31 December 2024, and its security support ends on 31 December 2026. In PHP's 21 October 2026 release announcement: "PHP 8.2 reaches end of life on 31 December 2026 and will receive no further security fixes after that date. Please plan your upgrade to a supported version."
Your website will not stop working on 1 January. It will keep running exactly as it does now. What stops is the fixes. PHP's advice for versions past end of life is that users "should upgrade as soon as possible, as they may be exposed to unpatched security vulnerabilities."
What October's PHP flaws showed
On 21 October 2026 PHP fixed two critical flaws, CVE-2026-109618 and CVE-2026-109619, which let an attacker take over a web server without logging in. PHP released fixed versions for every supported version: 8.5, 8.4, 8.3 and 8.2. PHP 8.2 got PHP 8.2.35, because it still has security support.
PHP 8.1 and older did not get a release. PHP's advisory says: "PHP 8.1 and older no longer receive updates from the PHP project." Because the flaws were so serious, PHP's security team also published source code fixes for 7.4, 8.0 and 8.1, for people who build PHP themselves, and some vendors released their own fixed copies. Everyone else on those older versions has to rely on their host or vendor for a fix.
After 31 December, a site on PHP 8.2 is in that same position for the next serious flaw. Whether PHP's security team would make an exception again is not something anyone can plan on.
Which PHP versions are supported, and until when?
These are PHP's own dates, from php.net.
| PHP version | Status on 22 October 2026 | Security fixes until |
|---|---|---|
| 8.5 | Full support | 31 December 2029 |
| 8.4 | Full support | 31 December 2028 |
| 8.3 | Security fixes only | 31 December 2027 |
| 8.2 | Security fixes only | 31 December 2026 |
| 8.1 | End of life | Ended 31 December 2025 |
| 8.0 | End of life | Ended 26 November 2023 |
| 7.4 | End of life | Ended 28 November 2022 |
Full support means PHP fixes bugs as well as security issues. PHP 8.4's full support ends on 31 December 2026 too, but that is not end of life: it keeps receiving security fixes for two more years.
How do I find out which PHP version my website runs?
- Ask your host or developer. Ask two questions: which PHP version does the site run, and does the host's copy of PHP still receive security fixes, and until when?
- If your hosting has cPanel, and your host has turned on MultiPHP Manager (under Software), that page lists each domain and the PHP version it uses. Look, but do not change the version there: switching PHP without testing first can break a site.
- Do not judge by the version number alone. Some hosts, and server operating systems such as Ubuntu, fix the version they already ship without changing its number to match PHP's. PHP itself notes that some vendors provide their own fixes for older versions. For example, Ubuntu fixed the October flaws in its own copies of PHP 8.3 on Ubuntu 24.04 and PHP 8.1 on Ubuntu 22.04. Only your host can tell you how long its copy of PHP 8.2 will keep receiving fixes, so ask.
Why upgrading PHP often means upgrading the CMS too
Each version of a content management system (CMS) supports a set range of PHP versions. If yours does not support a newer PHP, the CMS has to be upgraded first, or at the same time. These are the projects' own published ranges:
- WordPress. WordPress 7.1 lists PHP 7.4 to 8.5 as supported, and WordPress recommends "PHP version 8.3 or greater." For WordPress itself the move is usually straightforward. The work is in the theme and plugins: each one has to run on the new PHP version.
- Drupal. Drupal 10.4 to 10.6 support PHP 8.1 to 8.4. Drupal 11 lists PHP 8.3 and newer only, with 11.3 and 11.4 also supporting 8.5. Drupal 10 itself reaches end of life on 9 December 2026, three weeks before PHP 8.2, so a Drupal 10 site has two deadlines this December. Drupal 7 has been end of life since 5 January 2025 and "will no longer receive security or compatibility updates."
- Magento (Adobe Commerce). Adobe's system requirements list PHP 8.2 and 8.1 for Magento 2.4.6, 8.3 and 8.2 for 2.4.7, 8.4 and 8.3 for 2.4.8, and 8.5 for 2.4.9. A store on 2.4.6 cannot move off PHP 8.2 without upgrading Magento as well.
- Silverstripe. Silverstripe CMS 4 supports PHP 7.4 to 8.1, so it already runs on a PHP version past end of life, and Silverstripe 4 itself reached end of life on 10 June 2025. The way forward for those sites is a Silverstripe upgrade, and Silverstripe 6 gives the longer runway. Silverstripe 5.4 supports PHP 8.1 to 8.3, and its own security support ends on 30 April 2027. Silverstripe 6.2 supports PHP 8.3 to 8.5. Silverstripe's policy is that "When a PHP version reaches end-of-life, Silverstripe CMS drops support for it in the next minor release", so keeping Silverstripe up to date and keeping PHP supported go together.
- Custom applications. It depends on the code and the frameworks and libraries it is built on. A developer needs to check them against the new PHP version.
Which PHP version should I move to?
The newest PHP version that is still supported by PHP and by your CMS version, because it stays supported the longest. If your CMS version stops at PHP 8.2 or older (Silverstripe 4, Magento 2.4.6, Drupal 7), the CMS needs upgrading as part of the move.
For most sites today that is PHP 8.4, supported until 31 December 2028, or PHP 8.3 where the CMS stops there. Magento 2.4.8 goes up to 8.4, Magento 2.4.7 and Silverstripe 5.4 go up to 8.3. Drupal 10 also supports 8.4, but Drupal 10 itself ends on 9 December 2026, so a Drupal 10 site should plan the move to Drupal 11 (PHP 8.3 or newer) at the same time. PHP 8.3 only buys one more year: its support ends on 31 December 2027, so plan the next step at the same time.
Where your CMS version supports PHP 8.5 (WordPress 7.1, Drupal 11.3 and 11.4, Silverstripe 6.2, Magento 2.4.9), 8.5 stays supported longest, to 31 December 2029, provided the site's plugins, modules and custom code support it too.
What does a PHP upgrade involve?
At a high level, the same steps for any site:
- Check the site's code, theme, plugins, modules and extensions against the new PHP version, and the CMS version against its supported range.
- Update whatever needs it. Sometimes that is a few plugins; sometimes it is the CMS itself.
- Test on a copy of the site running the new PHP version: forms, logins, checkout, integrations and anything that runs on a schedule.
- Switch the live site over, check it again, and keep the old version available in case something needs to be rolled back.
How much work that is depends entirely on the site. A site that has been kept up to date may need little more than checking and testing. An older site, or one on a CMS version past its own end of life, will need more.
What should you do now?
- Find out which PHP version your website runs. Your host or developer can tell you.
- If it is PHP 8.2, ask your host whether its copy of PHP 8.2 will receive security fixes after 31 December 2026, and until when.
- Ask your developer which supported PHP version your CMS version runs on, and what has to change to get there.
- Schedule the upgrade, with testing on a copy, before 31 December. December is busy for most businesses and developers, so leave room.
- If your site runs PHP 8.1 or older, or a CMS version past end of life such as Silverstripe 4 or Drupal 7, put it first: it is already in the position PHP 8.2 will be in.
What this looks like with BLACKBX
BLACKBX looks after existing websites built on WordPress, Drupal, Magento, Silverstripe and custom applications.
On Maintenance and Full service, BLACKBX does the work. On Monitor, findings like this go to your own developer, so they can plan it. Upgrade work is quoted after one of our developers has looked at your site, because no two sites need the same work: see PHP and CMS upgrades. Maintenance starts from $840 a month + GST, and all plans are monthly, with no minimum term. Every change is recorded, dated, in a logbook you own.
Not sure where your site stands? Start with the free website health check at app.blackbx.com.au/inspect, or get in touch below to book a 20-minute call with a developer about your site.
Sources
- Supported versions, PHP, checked 22 October 2026
- Unsupported branches, PHP, checked 22 October 2026
- PHP 8.2.35 released, and Security advisory: Critical remote code execution vulnerabilities, update now, PHP, 21 October 2026
- USN-8948-1: PHP vulnerabilities, Ubuntu, 21 October 2026
- MultiPHP Manager for cPanel, cPanel documentation
- PHP compatibility and WordPress versions, WordPress Core Handbook
- Requirements, WordPress.org
- PHP requirements, Drupal.org
- Drupal core release schedule, Drupal.org
- Drupal 7 end of life, Drupal.org
- System requirements, Adobe Commerce documentation
- Server requirements, Silverstripe CMS 4, Silverstripe documentation
- Server requirements, Silverstripe CMS 5, Silverstripe documentation
- Server requirements, Silverstripe CMS 6, Silverstripe documentation
- Silverstripe CMS release dates and support, endoflife.date, checked 22 October 2026
Common questions
When does PHP 8.2 reach end of life?
PHP 8.2 reaches end of life on 31 December 2026. After that date, PHP will release no further security fixes for it. According to php.net, PHP 8.3 is supported until 31 December 2027, PHP 8.4 until 31 December 2028 and PHP 8.5 until 31 December 2029. PHP 8.1 and older are already end of life.
Will my website stop working on 1 January 2027?
No. A website running PHP 8.2 keeps working after 31 December 2026. What changes is that new security flaws found in PHP 8.2 will no longer be fixed by PHP. The critical PHP flaws fixed on 21 October 2026 (CVE-2026-109618 and CVE-2026-109619) showed what that means: PHP 8.2 got a fixed release, while PHP 8.1 and older did not. BLACKBX recommends moving to a supported PHP version before the end of the year.
How do I find out which PHP version my website uses?
Ask your host or developer. If your hosting account has cPanel and your host has turned on MultiPHP Manager, that page lists each domain and the PHP version it uses. Look, but do not change the version there without testing on a copy of the site first. Some hosts fix older PHP versions without changing the version number, so also ask whether your host's copy of PHP still receives security fixes, and until when.
Which PHP version should I upgrade to?
The newest PHP version that is still supported by PHP and by your CMS version, because it stays supported the longest. If your CMS version stops at PHP 8.2 or older, the CMS needs upgrading too. For most sites that is PHP 8.4, supported until 31 December 2028, or PHP 8.3, supported until 31 December 2027. Drupal 10, Magento 2.4.8 and Silverstripe 5.4 do not list PHP 8.5, so check your CMS version before choosing.
Do I need to upgrade my CMS as well as PHP?
Often, yes. Each CMS version supports a fixed range of PHP versions. Silverstripe 4 supports PHP up to 8.1, Magento 2.4.6 lists only PHP 8.1 and 8.2, and Drupal 11 lists PHP 8.3 and newer. Drupal 10 itself reaches end of life on 9 December 2026. A developer can check your site and tell you what has to change.
How much does a PHP upgrade cost?
It depends on the site: how old its CMS version is, how many plugins, modules or extensions it uses, and how much custom code it has. A site that has been kept up to date may need little more than checking and testing, while an older site may need a CMS upgrade as well. BLACKBX quotes upgrade work after one of its developers has looked at the site.
Running PHP 8.2?
Need to move your website off PHP 8.2?
Tell us about your website. A developer will look at what the move involves for your site, then quote the work. Every change is recorded in a logbook you own.
Or call +61 2 9043 1246. Monthly plans, no minimum term.