On 24 September 2026 PHP released four versions with security fixes, one for each of the branches 8.5, 8.4, 8.3 and 8.2. They are 8.5.11, 8.4.26, 8.3.35 and 8.2.34, and each of them fixes 11 vulnerabilities with CVE numbers. PHP 8.2, however, gets security fixes only until 31 December 2026. After that date the branch is no longer supported and new holes in it will not be fixed.
What happens to PHP 8.2
According to php.net, every branch gets two years of full support and then two more years of security fixes only. For 8.2 full support ended on 31 December 2024, and security fixes end on 31 December 2026. The table shows what the php.net page on supported versions says as of the date of this news.
| PHP version | Security fixes until |
|---|---|
| 8.5 | 31 December 2029 |
| 8.4 | 31 December 2028 |
| 8.3 | 31 December 2027 |
| 8.2 | 31 December 2026 |
| 8.1 | 31 December 2025, already past |
The fixes of 24 September are in PHP components such as OpenSSL, SOAP, Phar and FPM. There are none for 8.1 and older versions, because they are no longer supported, and php.net warns that older versions can expose a site to vulnerabilities that are fixed in newer ones.
What to do
First see which version the site runs. In the WordPress admin open Tools > Site Health, the Info tab and the Server section. The PHP version row shows the version.
If it is 8.1 or older, there are no fixes any more and the move should not wait. If it is 8.2, you have until the end of the year, but do not leave it for the last day. Versions 8.3, 8.4 and 8.5 are supported for longer, so pick the newest of them that your theme and plugins work with.
- Back up the files and the database, as described in the backup guide.
- Update WordPress, the theme and the plugins before you change the version.
- Change the version in cPanel, in the Software section. Depending on the server this is MultiPHP Manager or Select PHP Version.
- Go through the home page, the admin login and the forms, and for a shop the cart and the payment.
- If something breaks, switch back to the old version in the same place and ask the plugin's author.
What we do
With WordPress maintenance we update the system, PHP and the database and keep backups outside the server, so a version change has a way back. We do it on your server, wherever it is hosted. If you are unsure how to change the version, describe your site in the inquiry form.
Frequently asked questions
Until when does PHP 8.2 get security fixes?
Until 31 December 2026. Full support for PHP 8.2 ended on 31 December 2024, and after the end of 2026 new holes in the branch will not be fixed.
What does it mean when a PHP version is no longer supported?
According to php.net, every PHP branch gets two years of full support and then two more years of security fixes only. After that no fixes come out for it, even when new vulnerabilities are found. php.net warns that older versions can expose a site to vulnerabilities that are fixed in newer ones.
How do I see which PHP version my site runs?
In wp-admin open Tools > Site Health, the Info tab and the Server section. The PHP version row shows it.
Which PHP version should I move to from 8.2?
According to php.net's page on supported versions, PHP 8.3 gets security fixes until 31 December 2027, 8.4 until 31 December 2028 and 8.5 until 31 December 2029. Pick the newest of them that your theme and plugins work with.
Which PHP versions were released on 24 September 2026?
PHP 8.5.11, 8.4.26, 8.3.35 and 8.2.34, one for each supported branch. Each of them fixes 11 vulnerabilities with CVE numbers in PHP components such as OpenSSL, SOAP, Phar and FPM.
Does PHP 8.1 still get fixes?
No. Security fixes for PHP 8.1 stopped on 31 December 2025, and the releases of 24 September 2026 contain nothing for 8.1 or older branches. A site on PHP 8.1 or older should move to a supported version without delay.
How do I change the PHP version in cPanel?
In cPanel the version is changed in the Software section, with MultiPHP Manager or Select PHP Version depending on the server. Back up the files and the database first and update WordPress, the theme and the plugins. After the change, go through the home page, the admin login and the forms, and for a shop the cart and the payment as well.
What if my site breaks after the PHP change?
Switch back to the old PHP version in the same place in cPanel, MultiPHP Manager or Select PHP Version, and contact the author of the plugin that stopped working. The backup of files and database taken before the change is your way back if anything else goes wrong.