What Is PHP End of Life?

Definition

PHP end of life (EOL) is the date after which the PHP project stops releasing security fixes for a version of PHP, the language WordPress runs on. A site on an end-of-life version still works, but any new security flaw found in that version will stay unpatched on that server for good.

How It Works

PHP publishes a support schedule for each release branch. Per php.net, each branch gets two years of active support (bug and security fixes), then additional time for critical security fixes only, and then it reaches end of life. As of October 14, 2026, php.net lists:

PHP 8.2: security support until December 31, 2026.
PHP 8.3: security support until December 31, 2027.
PHP 8.1: end of life December 31, 2025.
PHP 8.0: end of life November 26, 2023.
PHP 7.4: end of life November 28, 2022.

php.net warns that "using older versions may expose you to security vulnerabilities and bugs that have been fixed in more recent versions of PHP."

Which PHP version a site runs is usually set by the hosting company or in the hosting control panel, not inside WordPress. Upgrading is often one setting, but old plugins and themes may break on newer PHP, which is why many sites get stuck. The safe path is to test on a staging copy, update or replace incompatible plugins, then switch production.

WordPress.org's live statistics on October 14, 2026 showed about 36.8% of reporting WordPress sites on PHP 8.1 or older, all past end of life, and about 24% more on PHP 8.2, which leaves security support at the end of 2026.

Real-World Example

In June 2024, a critical PHP flaw affecting PHP-CGI on Windows was disclosed (CVE-2024-4577, CVSS 9.8). It let attackers run commands on the server. PHP released fixes only for the supported branches, in versions 8.1.29, 8.2.20, and 8.3.8. CISA added the flaw to its Known Exploited Vulnerabilities catalog on June 12, 2024, and lists it as known to be used in ransomware campaigns. Servers on PHP 8.0, 7.4, or older, already past end of life, received no PHP fix and had to upgrade or apply workarounds.

Why It Matters for a Small Business

Many small business sites were built once and left on whatever PHP the host offered at the time. The site looks fine, so nobody notices it has slipped out of support. That leaves a permanent hole under every other defense. It can also fail insurance and compliance questions about supported software, and hosts eventually force upgrades on their own schedule, sometimes breaking the site without warning. Moving to a supported version also tends to make WordPress faster, so the upgrade usually pays for itself in performance as well as safety.

How to Spot It / How DTS Handles It

Warning signs: the WordPress Site Health screen recommending a PHP update, a hosting panel showing PHP 8.1 or older, plugins that "require PHP 8.2" and will not update, and a host email about retiring old PHP versions.

DTS can help with checking which PHP version a site runs, testing an upgrade on a staging copy, fixing or replacing plugins and themes that break, and planning the switch before the end-of-life date. See our WordPress maintenance service, or a one-time WordPress health check.

Related Terms

Patch management: keeping every layer, including PHP, on supported versions.
CVE: how flaws like CVE-2024-4577 are tracked.
CISA KEV catalog: the list of flaws known to be exploited.
Staging environment: where PHP upgrades are tested first.
Managed vs shared hosting: who controls the PHP version.
Abandoned plugin: a common blocker to PHP upgrades.
Plugin vulnerability: the other half of WordPress patching.

Sources

PHP.net, Supported Versions (checked October 14, 2026): https://www.php.net/supported-versions.php
PHP.net, Unsupported Branches (checked October 14, 2026): https://www.php.net/eol.php
WordPress.org, WordPress Stats: PHP versions (live data, checked October 14, 2026): https://wordpress.org/about/stats/
NIST NVD, CVE-2024-4577 (published June 9, 2024): https://nvd.nist.gov/vuln/detail/CVE-2024-4577

Last updated October 14, 2026.