If your website runs on PHP 8.2, the decision ahead of you is not just whether to move but how far. PHP 8.2 security support runs until 31 Dec 2026. After that date the branch gets no more fixes. The newer branches last longer: PHP 8.3 has security support to 31 Dec 2027, 8.4 to 31 Dec 2028, and 8.5 to 31 Dec 2029.
By our working, moving to 8.3 buys about one more year of fixes (2027 less 2026). Moving to 8.5 buys about three (2029 less 2026). The version your site can actually take depends on its theme, its plugins and what your host offers.
Here at Good Web Designer we would rather you found out which version you are on this month than in January. This article covers how to check, who makes the change, and what to ask.
How long does each PHP version get security fixes?
Security fixes end
Each bar runs from November 2026 to the end of that branch's security support.
PHP 8.1 and older no longer receive updates from the PHP project.
Sources: PHP supported versions, WordPress requirements, PHP news archive 2026
WordPress sets the floor. WordPress recommends hosting that supports PHP 8.3 or greater, and 8.3, 8.4 and 8.5 all clear it.
If your plugins are happy on 8.4 or 8.5, there is little reason to settle for only one extra year. Each move still means testing, and the less often you do it, the less often something can break.
What does "end of life" mean for a business website?
PHP's own definition is blunt. At end of life, a branch "is no longer supported. Users of this release should upgrade as soon as possible, as they may be exposed to unpatched security vulnerabilities."
The October patches show why the date matters. On 21 Oct 2026 PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Those releases fixed two critical vulnerabilities that can allow unauthenticated remote code execution, each rated CVSS v4.0 9.2. In plain terms, unpatched, they could let attackers run their own commands on your server. PHP's advice was that "updating is the only safe choice".
PHP 8.2 got that fix. The same notice also says PHP 8.2 "will receive no further security fixes after" 31 December 2026. So if a flaw like October's turns up in the new year, a site still on 8.2 won't get the patch.
October to December 2026
- 121 Oct 2026PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35, fixing two critical vulnerabilities (CVSS v4.0 9.2), and ASD's ACSC publishes its alert.
- 223 Oct 2026business.gov.au news item on the vulnerabilities.
- 319 Nov 2026 plannedPHP 8.6.0.
- 48 Dec 2026 scheduledWordPress 7.2.
- 531 Dec 2026PHP 8.2 end of life, no further security fixes.
Sources: PHP news archive 2026, ASD's ACSC alert, business.gov.au, WordPress 7.2 Beta 5
Two government sources picked up the October release:
- business.gov.au says the two vulnerabilities affect websites built with WordPress, Drupal and Joomla. Its advice is to check that your web developer, website host or IT provider has applied the patches, and to consider taking affected sites offline until they can be applied. If you have been impacted, call 1300 CYBER1 (1300 292 371).
- ASD's ACSC advises: identify PHP within your environments, apply security updates, and monitor PHP applications for suspicious activity.
How do I check my WordPress PHP version?
In WordPress, go to Dashboard > Tools > Site Health > Info tab > Server section > "PHP version". WordPress says 8.3 or higher means no update is needed now.
WordPress still works with PHP 7.4 and above. It warns, though, that those older versions "have reached their official End Of Life and may expose your site to security vulnerabilities".
What does my PHP version mean?
Server
- Branch 8.2 gets security fixes until 31 Dec 2026.
- Patch 35 matches the 21 Oct release.
- The version is below 8.3: WordPress recommends hosting that supports PHP 8.3 or greater.
Compare the options: 8.3 runs to 31 Dec 2027 and 8.5 runs to 31 Dec 2029.
Sources: WordPress, update PHP, PHP supported versions, PHP news archive 2026, WordPress requirements
The number has three parts, such as 8.2.35:
- The first two parts tell you the branch, and so its end date.
- The last part tells you how far that branch has been patched. If it sits below that branch's 21 October release, ask your host whether the fix has been applied.
If you see 8.1 or lower, note that "PHP 8.1 and older no longer receive updates from the PHP project". Some vendors backport fixes, so ask your host which applies to you.
Not on WordPress? Ask your host or developer which PHP version the site runs. business.gov.au names Drupal and Joomla sites as affected too.
Who actually changes PHP on my site?
Your host does, or you do through your host's settings. Updating WordPress does not update PHP: PHP is installed on the server, so changing it means using your host's settings or asking your host.
Your hosting company determines which PHP versions are available to your site, and many hosts let you change it yourself. If yours doesn't, email the host. WordPress supplies template wording you can adapt.
| Job | Who does it | Source |
|---|---|---|
| Find your PHP version | You, in Site Health | wordpress.org/support/update-php |
| Change the PHP version | Your host's settings, or your host on request | wordpress.org/support/update-php |
| Apply the 21 Oct security patches | Your web developer, website host or IT provider | business.gov.au |
| Update WordPress, themes and plugins | You or your developer | wordpress.org/support/update-php |
| PHP stop-gap settings | Host or developer, a server-level job | php.net archive |
You may also see mention of stop-gap settings that "reduce exposure" but "do not make an installation safe". Those are a server-level job for your host or developer, not something to change yourself.
Your own part is keeping WordPress, themes and plugins current. Our WordPress update routine walks through that step by step.
What should I check before changing PHP?
A plugin that works today may not work on a newer PHP. WordPress says it "can't guarantee" a PHP update will go smoothly, so check each plugin's and theme's last-updated date or ask its developer.
Have your way back ready before you start. If something breaks, ask the host to restore the previous PHP version and then restore your backup.
Before and after you change PHP
Source: WordPress, update PHP
Pick a quiet weekday for the switch, when you can check the site straight afterwards. A busy trading day is the wrong time to find out a contact form has stopped working.
Should I wait for PHP 8.6 or WordPress 7.2?
Two releases are coming:
Beta 5 says all known PHP 8.6 compatibility issues in core are resolved. You still need to check that your own plugins and themes work on 8.6 before moving to it. The beta is also "intended for testing and development only", so keep it off your live site.
Our view: don't wait for either before leaving 8.2. PHP 8.3, 8.4 and 8.5 all have security support past this year. The newest version is only the right one once your plugins are ready for it.
What to ask your host, word for word
Copy this into an email or support ticket. The version numbers in the first question are PHP's 21 October releases.
Hi, could you tell me:
- Which PHP version is my website running, and has the 21 October 2026 security release been applied (8.2.35, 8.3.36, 8.4.27, 8.5.12 or later)?
- PHP 8.2's security support ends on 31 December 2026. Which supported versions can my site move to, and can I switch it myself in my control panel?
- Do you offer a staging copy for testing, and can you restore my previous PHP version if something breaks?
When the reply comes back, you will know your version, your options and your way back. If you would like help reading what your host offers, or working out whether your plugins are ready, ask Good Web Designer through our contact page.