PHP support and PHP vulnerability fixes
| PHP branch | PHP2Shell fix | Active support until | Security support until | Upstream status |
|---|---|---|---|---|
| PHP 8.5 | 8.5.12 ↗ | 2027-12-31 | 2029-12-31 | Active support |
| PHP 8.4 | 8.4.27 ↗ | 2026-12-31 | 2028-12-31 | Active support |
| PHP 8.3 | 8.3.36 ↗ | 2025-12-31 | 2027-12-31 | Security fixes only |
| PHP 8.2 | 8.2.35 ↗ | 2024-12-31 | 2026-12-31 | Security fixes only |
| PHP 8.1 | No upstream release | Ended | 2025-12-31 | End of life |
| PHP 8.0 | No upstream release | Ended | 2023-11-26 | End of life |
| PHP 7.4 | No upstream release | Ended | 2022-11-28 | End of life |
Branch status checked at 2026-10-21 15:26:08 UTC. PHP support policy ↗
PHP 8.6 is a prerelease branch: do not select it for production. For branches older than those listed above, consult the PHP end-of-life table and your vendor's support policy.
For an end-of-life branch, the last upstream release does not establish a PHP2Shell fix. A vendor backport needs its own advisory and package revision.
Which PHP version should I use?
This guide uses PHP 8.4 as the default migration target. Its published support dates are shown above. A newer supported branch can offer a longer support period; application and extension compatibility must be tested before you switch.
Why a distribution version can look older
A vendor can add a PHP vulnerability fix while retaining the upstream version in its package name. Check the complete vendor revision against the advisory. Use the local checker to compare a full package revision instead of the short version.
Compare your package →PHP2Shell release history
Plan a supported-version migration
Review each intermediate PHP migration guide before changing branches, and test the application and extensions in staging.