PHP 8.2 End of Life: December 31, 2026 (What Changes and How to Upgrade)

PHP 8.2 receives security fixes until December 31, 2026, and none after that. That is what the supported versions page on php.net says (checked on November 13, 2026), and it is the only source that rules here. Nothing stops working on January 1: PHP has no internal expiry date. What changes is that any security flaw discovered in PHP 8.2 from that day on stays open. The last 8.2 release at the time of writing is 8.2.35, from October 21, 2026 (php.net release feed).

If you run 8.2, you have about six weeks. Here are the dates, which Laravel versions let you leave 8.2 without a framework upgrade, and the order I would do it in. There is a Spanish version of this article aimed at business owners; this one is for the person who has to do the work.

The dates, unrounded

Since 2024 each PHP version lives four years: two of active support (bug and security fixes) and two of critical security fixes only.

Source: php.net/supported-versions.php for the support dates and the php.net release feed for the latest releases, both checked on November 13, 2026 (the latest versions match endoflife.date/php). PHP 8.6 is not in the table because it has not been released yet; what breaks when upgrading to PHP 8.6 covers it, and JetBrains places its release “later this November” in its PhpStorm 2026.3 post.

Note that 8.3 has already spent ten months on security fixes only. It is a stop on the way, not a place to stay for five years.

Laravel: can you leave 8.2 without upgrading the framework?

Often, yes. The Laravel release notes list the PHP versions each major supports (checked November 13, 2026):

Upgrading only PHP does not fix a framework that is out of support, but it closes the biggest hole (the language itself) with far less work than a framework migration. For a Laravel 12 app it is the whole job. For Laravel 11 and 10 it is the first step; the next one is what breaks upgrading to Laravel 13. Anything older than Laravel 10 has been out of support for years.

What actually happens on January 1

Your app does not stop working on January 1, and you are not hacked the next morning: the risk grows over time. What does happen:

1. New vulnerabilities stay unpatched. PHP’s own release feed shows the pace: 8.2.35, 8.3.36, 8.4.27 and 8.5.12 all shipped on the same day (October 21, 2026) as security releases. From 2027 that stream stops for 8.2. Not every CVE affects you (one in SOAP is irrelevant if you don’t use SOAP), but someone has to make that call for every advisory, forever.
2. Your host may retire the version. Providers do not keep dead versions indefinitely. Ask yours, in writing, what they plan for 8.2; I found no public retirement date for the most common shared hosts.
3. Libraries raise their minimum. Laravel 13 already requires PHP 8.3 (laravel/framework 13.x declares php: ^8.3 on Packagist), and third-party packages follow their frameworks. An 8.2 system keeps running but fewer packages publish versions it can install, security patches included.
4. Audits. Compliance frameworks that ask for supported software (PCI DSS is the usual one) will flag a runtime with an announced end of life. Confirm the exact wording with whoever handles compliance; I have not quoted it here.

How to check what you run

# On the server
php -v

# In a Laravel project
php artisan --version
composer show laravel/framework | grep versions

On servers with several PHP versions installed, the terminal’s PHP may not be the one serving the web: check the PHP-FPM pool or the vhost config. And the "php" line in composer.json says what the project accepts, not what is running. In CI and containers, grep for the pinned version:

grep -rnE "php-version|php:8\.2|8\.2" .github/workflows/ Dockerfile* docker-compose*.yml composer.json 2>/dev/null

The upgrade, in order

1. Pick the target. 8.4 is the sensible default today: security fixes until December 31, 2028, and every Laravel from 11 up supports it. 8.5 works for Laravel 12 and 13 if your dependencies declare it.
2. Raise PHP in a copy, not in production. Update the php requirement in composer.json, run composer update on that branch and run your tests. Anything that breaks is a package pinned to an old PHP; the error says which.
3. Add the new version to your CI matrix first, keeping 8.2 for a week, so you see failures before they are the only option.
4. Move the runtime (Docker image tag, setup-php version, hosting panel) and keep the old one one click away for rollback.
5. Only then plan the framework jump, one major at a time, with tests between each.

If the app is not worth that effort, the honest alternatives are to freeze it behind a VPN or a WAF with a written review date, or to replace it. Freezing without a date is just “let’s look at it later”, which is what brought you here.

Frequently asked questions

When does PHP 8.2 reach end of life?

PHP 8.2 receives security fixes until December 31, 2026, according to php.net/supported-versions.php. Bug fixes ended on December 31, 2024. After December 31, 2026 the PHP project will publish no more releases of the 8.2 branch.

Will my PHP 8.2 app stop working on January 1, 2027?

No. PHP has no internal expiry date and the app keeps running exactly as before. What changes is that new vulnerabilities discovered in PHP 8.2 are no longer fixed, hosting providers start retiring the version, and fewer libraries publish compatible releases.

Which PHP version should I upgrade to from 8.2?

PHP 8.4 is the safe default: security fixes until December 31, 2028, supported by Laravel 11, 12 and 13. PHP 8.3 works but its security-only window ends on December 31, 2027. PHP 8.5 is supported until December 31, 2029 and works with Laravel 12 and 13.

Can I upgrade PHP without upgrading Laravel?

Depending on the version. Laravel 12 supports PHP 8.2 to 8.5, Laravel 11 supports 8.2 to 8.4 and Laravel 10 supports 8.1 to 8.3, so you can leave PHP 8.2 without changing Laravel. That does not fix a Laravel version that is itself out of support.

What is the latest PHP 8.2 version?

As of November 13, 2026 it is PHP 8.2.35, released on October 21, 2026 according to the php.net release feed. If your server reports a lower 8.2 number, you are missing security fixes that already exist.