An end-of-life PHP version keeps running, and that is exactly the problem: nothing tells you it no longer receives security fixes. On October 21, 2026, PHP shipped emergency fixes for two critical remote code execution flaws, and the end-of-life branches did not officially get them. Here is the schedule you need to know, what it actually changes for a WordPress site, and a way to migrate without breaking anything.
The official schedule
The PHP project maintains each branch for four years: two years of active support (bug and security fixes), then two years of security fixes only, released as needed. End dates now all fall on December 31.
| Branch | Released | End of active support | End of security fixes | Status on October 27, 2026 |
|---|---|---|---|---|
| PHP 7.4 | November 28, 2019 | November 28, 2021 | November 28, 2022 | End of life (last release 7.4.33) |
| PHP 8.0 | November 26, 2020 | November 26, 2022 | November 26, 2023 | End of life (last release 8.0.30) |
| PHP 8.1 | November 25, 2021 | November 25, 2023 | December 31, 2025 | End of life (last release 8.1.34) |
| PHP 8.2 | December 8, 2022 | December 31, 2024 | December 31, 2026 | Security only, two months left |
| PHP 8.3 | November 23, 2023 | December 31, 2025 | December 31, 2027 | Security only |
| PHP 8.4 | November 21, 2024 | December 31, 2026 | December 31, 2028 | Active support |
| PHP 8.5 | November 20, 2025 | December 31, 2027 | December 31, 2029 | Active support |
What "end of life" actually changes
The October 2026 example
On October 21, 2026, the PHP team released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix CVE-2026-109618 and CVE-2026-109619, two flaws rated 9.2 (CVSS 4.0) that allow unauthenticated remote code execution. The PHP advisory states that every installation serving web pages is affected (PHP-FPM, Apache module, CGI, LiteSpeed, and so on), with the highest risk for the Apache module. According to BleepingComputer, Cloudflare was already seeing attacks before the fixes were released.
For end-of-life branches, the advisory is blunt: PHP 8.1 and earlier no longer receive updates from the project. As an exception, the team published minimal backports as source code for 7.4, 8.0 and 8.1, intended for people who compile PHP themselves. A site on shared hosting running PHP 7.4 therefore depends entirely on its host, which must have applied that fix by hand or through an extended support vendor.
Flaws pile up silently
Even without a crisis, the gap widens quickly. Since the last PHP 8.1 release (8.1.34, published December 18, 2025), the 8.2 branch received four security releases in 2026 before the October one (8.2.31 in May, 8.2.32 and 8.2.33 in July, 8.2.34 in September), which together fix more than twenty CVE identifiers according to the PHP changelog. None of them exists for 8.1.
| Risk | Explanation | Who is affected |
|---|---|---|
| Known flaws left unpatched | Fixes are no longer released for the branch | Every site on the branch |
| Easier exploitation | Fixes in maintained branches show where the flaws are | Sites visible on the Internet |
| Plugins dropping the version | Vendors stop testing and supporting the branch | Sites that update their plugins |
| WordPress updates blocked | WordPress 7.0 requires at least PHP 7.4 | Sites still on PHP 7.2 or 7.3 |
| Host stops offering it | Version removed or billed as extended support | Sites that have not migrated |
Where WordPress sites stand
According to the public wordpress.org statistics, about 33.6% of WordPress sites that contact wordpress.org run on a PHP version that is already end of life (8.1 or earlier), including 15.1% on PHP 7.4. If nothing changes, PHP 8.2 (23.2%) will join them on December 31, 2026: more than one site in two would then be on a version without official fixes.
On the WordPress side, the requirements page recommends PHP 8.3 or newer, while noting that WordPress still works with PHP 7.4, a version it describes as end of life. WordPress 7.0 and 7.1 support PHP 7.4 through 8.5.
Migrating without breaking anything
- Check the current version: Tools, Site Health, Info tab, Server section. The Dashboard also shows a warning when the version is considered too old.
- Pick your target: PHP 8.3 at a minimum (security fixes until the end of 2027), or 8.4 if your host offers it and your plugins support it, which buys you two more years.
- Update everything before switching PHP: WordPress, theme and plugins. Recent plugin releases are the ones that have been adapted to newer PHP versions.
- Test on a copy (staging): switch the PHP version, enable
WP_DEBUG_LOGand go through the site, the admin area, forms, the store and scheduled tasks. Read the log file to spot fatal errors and deprecation warnings. - Replace whatever blocks you: a plugin that throws a fatal error on PHP 8.3 and has not been updated in a long time is probably abandoned.
- Switch production from your hosting control panel (PHP version selector), right after a full backup, then clear the caches.
- Monitor the error log for a few days, then turn off displaying and logging debug errors in production.
If your host does not offer a maintained version, that is a strong signal to change hosts.
With WP Masquerade
WP Masquerade requires at least PHP 7.4, like WordPress, and obviously cannot patch PHP. It can, however, limit what your site advertises: the Pro version manages security headers, and email alerts notify you of security events. For the PHP version itself, also consider expose_php = Off, which removes the X-Powered-By header that reveals the exact version. The hosting and cache compatibility page lists the tested environments.
Read also: Understanding WordPress errors and debugging your site.
Key takeaways
- PHP 8.1 and earlier are end of life; PHP 8.2 will be on December 31, 2026.
- In October 2026, two critical flaws were fixed only in branches 8.2 through 8.5.
- About a third of WordPress sites already run on an end-of-life PHP version.
- Recommended target: PHP 8.3 or 8.4, tested first on a copy of the site.
- Update plugins and theme before changing PHP versions.
Sources
- PHP: Supported Versions (opens in a new tab)
- PHP: Unsupported Branches (end of life) (opens in a new tab)
- WordPress.org: Requirements (opens in a new tab)
- Make WordPress Core: PHP Compatibility and WordPress Versions (opens in a new tab)
Other sources consulted: official documentation and trade press articles.
