Short answer
A supported PHP version belongs to a branch that still receives upstream fixes. Active support includes bug fixes; security-only support focuses on security issues. End of life means ordinary upstream support has ended. Being on a supported branch does not mean your installation is patched.
Which PHP versions are supported?
PHP’s official lifecycle, checked October 21, 2026:
- 8.2: security-only support through December 31, 2026.
- 8.3: security-only support through December 31, 2027.
- 8.4: active support through December 31, 2026; security support through December 31, 2028.
- 8.5: active support through December 31, 2027; security support through December 31, 2029.
Each branch gets two years of active support followed by two years of security support. Use the official page for the current status; a saved screenshot does not age especially well.
Branch versus patch release
In a version such as 8.4.27, 8.4 identifies the branch and .27 the patch release. Two websites can both report “PHP 8.4” while only one has an applicable security fix.
PHP2Shell made that distinction concrete. PHP’s October 21 advisory names fixed releases in each supported branch. A supported but older patch level still needs attention.
“WordPress runs on it” is a third, separate statement: compatibility. WordPress’s requirements explicitly warn that some compatible legacy versions are end of life. Compatible, supported and patched are three different checks.
What about older vendor-maintained packages?
An operating-system vendor may provide a security backport after ordinary upstream support ends. Verify coverage for your exact package and operating-system release, then match the installed package revision to the vendor advisory.
PHP also provided exceptional minimal source backports for PHP 7.4, 8.0 and 8.1 for the October 2026 incident. The PHP advisory does not describe that as a return to ordinary support.
How to choose an upgrade target
First, apply the applicable security fix. Then plan a supported branch with enough remaining lifetime for the project and compatibility with its application, extensions and host.
For a WordPress store, check WooCommerce and payment extensions, not just WordPress core. For Magento, use the requirements for the exact edition and release. The newest branch is not automatically the right target for every installation today.
The deployment checklist is short: identify the applicable fix, choose a target branch with enough remaining lifetime, confirm application and extension compatibility, and keep a rollback path.