Security support is a phase in which a PHP version only gets fixes for security problems. Ordinary bugs are no longer repaired. It is the last stretch in which your PHP version still gets official protection.
What is security support?
It sits between full active supportActive support is the phase in which a PHP version is fully looked after: both ordinary bugs and security problems get fixed, with regular updates. and end of lifeEnd of life (EOL) means the makers have stopped looking after a version of software. It still works, but it no longer gets updates, not even security fixes..
The PHP project gives each branch a fixed schedule. For roughly the first two years a branch is in active support, with fixes for bugs and for security problems. After that the branch moves to security support and stays there until its final date. During that time, a patch release only appears when a security problem has to be fixed.
For you as a site owner this means that things which are merely annoying, such as a bug in one function, will probably not be fixed anymore, while dangerous problems are. The branch is stable and supported, but the clock is running.
The dates from php.net
As read on php.net on October 21, 2026, PHP 8.2 is in security support until December 31, 2026, and PHP 8.3 until December 31, 2027. PHP 8.4 has security support until December 31, 2028 and PHP 8.5 until December 31, 2029, but both are still in active support for now.
What security support means for your site
Being in security support means you are still covered when something serious is found, provided you install the patch release. The PHP releases of October 21, 2026 show how it works in practice: the project published PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which close two critical vulnerabilities. Branches in security support got that fix like the others.
It also means the end date is a planning deadline. A site on PHP 8.2 has until the end of 2026 for a tested upgrade, and rushing an upgrade of a business site in December is more risky than doing it now.
How to check where your site stands
Look up your full PHP versionA PHP version is a numbered edition of PHP, like 8.3. Each edition is looked after for a limited time, then gets security fixes only, then nothing., including the patch number, in your hostingWeb hosting is the service that keeps your website's files on a computer that is always online, so visitors can open your site at any time. panel or in a phpinfo page. Compare the branch with the table on php.net. Then check the patch number against the latest release in that branch. A site on a supported branch but several patch releases behind has no benefit from the support it is entitled to.
You can also check your PHP version with the free tool to see what your site shows to the public.
When to act
Plan the upgrade as soon as your branch enters security support, and finish it comfortably before the final date. Do not wait for the last month. We update PHP in WordPress by taking your site to a branch with active support, and we keep the old version available as a way back until you are sure everything works. If you want the background first, read what PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it. is.
Frequently asked questions
What is the difference between active support and security support?
In active support a branch gets fixes for bugs and security problems. In security support it only gets fixes for security problems. Ordinary bugs stay as they are.
Which PHP versions are in security support now?
According to php.net, read on October 21, 2026, PHP 8.2 and 8.3 only get security fixes, until December 31, 2026 and December 31, 2027. PHP 8.4 and 8.5 are still in active support.
Is a branch in security support safe to use?
It still receives official fixes for security problems, so it is supported. Keep installing the patch releases, because a fix only helps once it is on your server.
What happens after security support ends?
The branch reaches end of life. The PHP project stops releasing any fixes for it, including security fixes.