Brandbrand
Book a call
Brandbrand
Book a call
A blue plush elephant with the PHP logo, the mascot of PHP

PHP 8.2 ends on 31 December

After New Year PHP 8.2 gets no more security updates. What that means for your web shop, and how we keep our own sites up to date.

6 November 20262 min read, about security

What stops on 31 December

Every PHP version gets four years of support: two years of all bug fixes, then two years of security updates only. PHP 8.2 was released on 8 December 2022. The regular bug fixes stopped at the end of 2024; on 31 December 2026 the security updates stop too.

On the day itself nothing changes. Your site keeps working. The difference is in what gets found afterwards: a hole in PHP 8.2 is no longer fixed, and the software your site runs on drops 8.2. Drupal 11 already asks for PHP 8.3, Symfony 8 asks for 8.4.

Which version does your site run?

Until 31 December

PHP 8.2 gets security updates through 31 December 2026. Start the move now, so it doesn't land in the last week.

Your version is in your hosting panel. Data from php.net.

What if you are on Shopify?

Then your store itself does not run on your PHP: Shopify hosts the store and keeps it up to date. But everything you had built next to it does. A custom app, a link with your accounting, a Drupal site with your blog: they run on a server with a PHP version, and you or your agency are responsible for that.

Our stance

We do not let a site run on a PHP version without security updates.
Remco, CTO at Brandbrand

What we do

This site runs on PHP 8.4, which gets security updates until the end of 2028.

We do not install updates whenever it happens to suit. Our Updater tracks which updates are available for each site, and a security update goes through review and live the same day. This is how it went on 5 November with this site:

Drupal updates 2026-11-05 (security), merged
symfony/http-kernelv7.4.21v7.4.23
symfony/http-foundationv7.4.21v7.4.23
symfony/routingv7.4.21v7.4.23
symfony/serializerv7.4.21v7.4.23
symfony/validatorv7.4.21v7.4.23
symfony/filesystemv7.4.21v7.4.23
symfony/yamlv7.4.21v7.4.23
symfony/error-handlerv7.4.20v7.4.22
symfony/processv7.4.21v7.4.22
symfony/var-dumperv7.4.21v7.4.22
Ten Symfony packages updated: ready at 10:17, live at 10:58.

What you can do now

  • Look up your PHP version in your hosting panel, for every site and app you have.
  • Is anything running on 8.2 or older? Plan the move to 8.4 before the holidays. You would rather not test a move in the last week of December.
  • Ask your agency how they keep updates up to date, and how quickly a security update goes live for you.

Do you not know where your app or link runs? Email us and we will take a look.

Header photo: "Blue Open Goodies ElePHPant" by Atomic Taco, CC BY-SA 2.0, via Wikimedia Commons.