PHP 8.2 end of life: 31 December 2026
PHP 8.2 gets its last security fixes from the PHP project at the end of this year. Here is whether that affects your servers, where to move, and how to do it without breaking sites.
- Security support
- Ends 31 Dec 2026, 55 days left
- On Debian 12
- Patched by Debian LTS to June 2028
- Move to
- PHP 8.4 (to Dec 2028) or 8.5 (to Dec 2029)
- Path
- Straight to the new version, site by site
Does the date affect you?
Check where your PHP comes from: php -v for the version, then dpkg -S $(which php) on Debian or Ubuntu, or rpm -qf $(which php) on RHEL-style systems, for the package.
Debian 12's own package: Debian keeps patching it through its Long Term Support, to June 2028. The date matters less, but every scan will report "8.2" as end of life from January.
A third-party repository, a control panel's builds or a Docker image: these follow PHP's own dates. From January there are no more fixes, so the move needs to be planned now.
In both cases, customers' security questionnaires ask about version numbers. A server on 8.4 needs no explaining.
What breaks on the way up
From 8.2 the steps are lighter than the ones before. These are the changes that catch most sites.
| Step | Supported to | What to watch |
|---|---|---|
| 8.2 → 8.3 | 31 Dec 2027 | The smallest step. A few deprecations (calling get_class() with no argument, for one) and stricter behaviour in some date and range functions. |
| 8.3 → 8.4 | 31 Dec 2028 | A default of null on a typed parameter without ? (function f(Foo $x = null)) is deprecated, and older code is full of it. The IMAP, OCI8 and Pspell extensions leave core for PECL, so code using imap_* needs the extension installed separately or a library instead. |
| 8.4 → 8.5 | 31 Dec 2029 | The backtick shell operator and old cast names such as (integer) and (boolean) are deprecated. Check your framework and main plugins support 8.5 before choosing it. |
Dates from php.net, read 6 November 2026. PHP 8.6 is at its fifth release candidate and due later this month.
8.4 or 8.5?
8.4 for most sites. It has been out for two years, WordPress, Laravel and the main libraries all support it, and it is patched to the end of 2028.
8.5 if everything you run supports it. It buys an extra year, to the end of 2029. Check your framework's and main plugins' stated support first: a version a year old is where the gaps show.
Skip 8.3. It is supported for a year less than 8.4, and moving to it is almost the same work.
How to upgrade a server
Install the new version alongside 8.2, each with its own PHP-FPM service, from a supported PHP repository.
Match the settings and extensions. Compare php.ini and the FPM pool settings, and install every extension the sites use. A missing extension is the usual cause of a blank page.
Move one site at a time, pointing its web server configuration at the new FPM socket, and point it back if anything is wrong.
Move the command line too. Cron jobs, queue workers and Composer use the CLI version, set with update-alternatives --config php.
Watch the logs for a couple of weeks, then remove 8.2.
How I run the move
- 01Inventory and a fixed quote
Every site and job on the server, the PHP version each one needs, and which of the changes above will bite. Then a fixed quote.
- 02Rehearsal on staging
A copy upgraded or rebuilt first, every site and job tested, every problem fixed there.
- 03The window, with a way back
The real move at a time you agree, the old server or a snapshot kept ready, then two weeks' stabilisation.
Upgrades and migrations →
Questions
When does PHP 8.2 reach end of life?
On 31 December 2026, when its security support ends. After that the PHP project releases no more fixes for 8.2.
Is PHP 8.2 on Debian 12 still patched after that?
Yes, by Debian rather than by PHP. Debian 12's own PHP 8.2 package gets fixes through Debian's Long Term Support to June 2028. Scanners and customers will still flag "8.2" from January.
Which version should I move to?
PHP 8.4, supported to the end of 2028, suits most sites. PHP 8.5 runs to the end of 2029 if your framework and plugins support it. PHP 8.6 is due in late November 2026.
Is 8.2 to 8.4 a big job?
Usually smaller than 8.1 to 8.2 was. The 8.3 step is light, and the main 8.4 work is the implicitly nullable parameter deprecation and any code using the IMAP extension.
Can I run two PHP versions on one server?
Yes, with PHP-FPM. Install the new version beside the old one and move sites across one at a time, each with its own pool.
What if I can't upgrade by January?
If your PHP comes from Debian 12, you are still patched, and you have until mid-2028. If it comes from a third-party repository or a Docker image, plan the move now, or buy paid support from a vendor such as Zend or TuxCare for the gap.
Running PHP 8.2?
Tell me what runs on it. I'll tell you what will break on 8.4 and give you a fixed quote for the move, done before January.