Security support until 31 December 2027
PHP 8.3
- Security fixes only since 31 December 2025.
- A shorter step from 8.1 or 8.2: fewer deprecations to handle.
- Suited when a dependency, an extension or the host does not support PHP 8.4 yet.
PHP migration · php.net schedule
PHP 8.2 → 8.3 / 8.4 migration: end of support on 31 December 2026.
According to php.net, PHP 8.2 receives its last security fixes until 31 December 2026. After that date, a vulnerability found in PHP 8.2 is no longer fixed by the PHP project. The 8.3 branch (until 31 December 2027) and the 8.4 branch (until 31 December 2028) are the most common migration targets; PHP 8.1 and earlier versions have already reached end of life.
§ 01 / Schedule
Support schedule of PHP versions.
In the php.net schedule, each recent branch gets about two years of active support (bug and security fixes), then two years of security fixes only. After that, it reaches end of life.
| Version | Released | Active support until | Security support until | Status |
|---|---|---|---|---|
| PHP 8.5 | 20 November 2025 | 31 December 2027 | 31 December 2029 | Maintained |
| PHP 8.4 | 21 November 2024 | 31 December 2026 | 31 December 2028 | Target |
| PHP 8.3 | 23 November 2023 | 31 December 2025 | 31 December 2027 | Target |
| PHP 8.2 | 8 December 2022 | 31 December 2024 | 31 December 2026 | To migrate |
| Version | End of life | Last release |
|---|---|---|
| PHP 8.1 | 31 December 2025 | 8.1.34 |
| PHP 8.0 | 26 November 2023 | 8.0.30 |
| PHP 7.4 | 28 November 2022 | 7.4.33 |
| PHP 5.6 | 31 December 2018 | 5.6.40 |
Sources: php.net, supported versions and unsupported branches, checked on 22 October 2026.
§ 02 / Why migrate
Why migrate before 31 December 2026.
-
Step 1: No more fixes after the date
php.net warns that users of an end-of-life branch may be exposed to vulnerabilities that will not be fixed. The site keeps running, but every new vulnerability stays open.
-
Step 2: PHP2Shell proved it
In October 2026, the PHP2Shell vulnerability was fixed for PHP 8.2 to 8.5 only. Sites on PHP 8.1 or older got neither a fixed version nor any grace period: emergency filtering, then a forced migration.
-
Step 3: Dependencies follow PHP
Frameworks raise their minimum PHP version: Symfony 7.4 requires PHP 8.2, Symfony 8 requires PHP 8.4. Staying on an old PHP version also blocks the security updates of your libraries.
-
Step 4: Choose your moment
Migrating before the deadline means choosing the date, testing without pressure and keeping the old version ready. Migrating after an alert means doing it in a rush.
§ 03 / Choose the target
PHP 8.3 or PHP 8.4: which target to choose?
There is no single right answer: the target depends on your dependencies, your hosting and the horizon you aim for. Both are maintained; here is what sets them apart.
Security support until 31 December 2028
PHP 8.4
- One more year of support than PHP 8.3; active support until 31 December 2026.
- Minimum required by Symfony 8.x.
- Four extensions removed from the distribution (IMAP, OCI8, PDO_OCI, PSpell): check them first.
§ 04 / Method
Our migration method.
Five steps, the same for one application or for a whole fleet. Nothing goes to production without your approval.
-
Step 1: Inventory
PHP version served, loaded extensions, Composer dependencies and their constraints, scheduled tasks (which use the command-line PHP), available environments, hosting.
-
Step 2: Before/after test bench
Two identical environments, one on the current version, the other on the target, with the same data. Deprecation logs are enabled on both.
-
Step 3: Behaviour comparison
Critical journeys are replayed on both sides: login, forms, file uploads, payments, exports, scheduled tasks. Every difference is logged, fixed, then checked.
-
Step 4: Approved go-live
You approve the bench, then the date. The switch happens at the chosen time, batch by batch for a fleet, and the code stays in your Git.
-
Step 5: Rollback planned
The old PHP version and the old code remain ready to be put back into service. The rollback procedure is written before the switch, not after an incident.
§ 05 / Pitfalls
Technical pitfalls.
What breaks most often during a PHP version upgrade, and how to spot it before going to production.
-
Extensions
PHP 8.4 no longer ships IMAP, OCI8, PDO_OCI and PSpell: these extensions move to PECL. Compare the list of loaded modules between the old and the new version, for the command line and for FPM.
php -m php-fpm8.4 -m -
Deprecations
Each version deprecates usages that will disappear later. In 8.3: incrementing an empty or non-numeric string, calling get_class() without an argument. In 8.4: implicitly nullable parameters, trigger_error() with E_USER_ERROR. The bench logs reveal them before they turn into errors.
-
Composer dependencies
A library that caps its PHP version blocks the migration. Composer tells you which packages prevent the target and whether the platform meets every constraint.
composer why-not php 8.4 composer check-platform-reqs -
Frameworks
The framework version sets the minimum PHP version: Symfony 6.4 requires PHP 8.1, Symfony 7.4 PHP 8.2, Symfony 8 PHP 8.4. An old Symfony or Drupal application is often migrated together with PHP.
-
Configuration and scheduled tasks
Each PHP has its own configuration: the command-line one is not the FPM one. Scheduled tasks and deployment scripts often call a “php” that is not the one serving the site: they must switch versions at the same time.
Official guides: php.net, migrating to PHP 8.3 and to PHP 8.4 (links in the sources).
§ 06 / Offer
Migrate at a fixed price.
The PHP, Symfony, Drupal migration offer covers PHP 8.2 → 8.3 or 8.4, Symfony 6.4 → 7.4 LTS or 8.x and Drupal 10 → 11, with a before/after test bench and a planned rollback. Scope, price and deliverable are written down before we start.
- Fixed price, on quote. Up to 3 times cheaper than the European market, for the same standards and expertise.
§ 07 / Questions
Frequently asked questions about PHP migration.
What happens to a PHP 8.2 site after 31 December 2026?
The site keeps working, but the PHP project no longer publishes any security fix for the 8.2 branch. Any vulnerability found afterwards stays open, as happened to PHP 8.1 and earlier versions with PHP2Shell in October 2026.
Can we go straight from PHP 7.4 to PHP 8.4?
Yes, but by handling the changes of each intermediate version (8.0, 8.1, 8.2, 8.3 then 8.4), documented in the php.net migration guides. The framework often has to follow: Symfony 8 requires PHP 8.4. Depending on the inventory, the migration is done in a single switch or in successive steps, each one validated on the bench.
Why not migrate straight to PHP 8.5?
It is possible, and it is the branch maintained the longest (security support until 31 December 2029), provided all your dependencies, extensions and your hosting support it. When that is not yet the case, PHP 8.4 or 8.3 give you a maintained version without waiting.
Will my PHP extensions be available in PHP 8.4?
Most of them, yes. PHP 8.4 no longer ships four extensions in its distribution: IMAP, OCI8, PDO_OCI and PSpell, now published on PECL. If your application uses them, they must be installed from PECL or replaced; the inventory spots this before the migration.
Which PHP version does Symfony require?
According to symfony.com: PHP 8.1 minimum for Symfony 6.4, PHP 8.2 minimum for Symfony 7.4 LTS and PHP 8.4 minimum for Symfony 8.x. An old Symfony application often blocks the PHP upgrade: we then handle both together, step by step.
Will the site go down during the migration?
The work is done on a separate bench, without touching production. The switch happens when you choose, and the old version remains ready to be put back into service if a problem appears.
What do you need from us to get started?
The site address or the application name, its PHP and framework versions, the hosting (dedicated server, shared hosting, containers) and what is urgent. We get back to you in writing with a first opinion; scope, price and deliverable are written down before we start.
§ 08 / Sources
Sources.
- php.net, supported versions
- php.net, unsupported branches
- php.net, migrating to PHP 8.3
- php.net, migrating to PHP 8.4
- php.net, extensions removed from PHP 8.4
- symfony.com/releases
- getcomposer.org, commands
Sources checked on 22 October 2026; this page is updated when the php.net schedule changes.
An application on PHP 8.2 or older to migrate?
Tell us which application is concerned, its PHP and framework versions, and where it is hosted. We get back to you in writing with a first opinion and the possible next steps.