Is my PHP version still safe? · Security support ends 2026-12-31
Is PHP 8.2 still safe?
The PHP project publishes support dates for every branch. PHP 8.2 is still covered, and 8.2.35 closes the October 2026 PHP2Shell bugs.
Last updated
Status at a glance
| Item | Value |
|---|---|
| Initial release | 2022-12-08 |
| Active support until | 2024-12-31 |
| Security support until | 2026-12-31 |
| PHP2Shell (CVE-2026-109618/109619) | Vulnerable before 8.2.35; fixed in 8.2.35 (21 October 2026) |
What to do
Install 8.2.35 today, then upgrade to 8.4 or 8.5. After 2026-12-31 php.net will publish no more 8.2 releases, even for critical bugs.
Other PHP branches
- PHP 8.5Supported · PHP2Shell: 8.5.12
- PHP 8.4Supported · PHP2Shell: 8.4.27
- PHP 8.3Security fixes only · PHP2Shell: 8.3.36
- PHP 8.1End of life
- PHP 8.0End of life
- PHP 7.4End of life
Is PHP 8.2 affected by PHP2Shell?
Yes, before 8.2.35. The PHP security team lists 8.2 before 8.2.35 as affected by both CVEs.
How long is PHP 8.2 supported?
php.net lists security support for 8.2 until 2026-12-31.
My distro shows an older 8.2 version. Am I vulnerable?
Not necessarily. Debian, Ubuntu and others backport fixes; compare the full package version with your distro’s tracker.
Sources
Outbound links leave this site. We do not host exploit code.
- Supported Versions — PHP project (php.net)
- Unsupported Branches — PHP project (php.net)
- News archive 2026: security advisory, 21 October 2026 — PHP project (php.net)
- CVE-2026-109618 — Ubuntu Security (Canonical)
- CVE-2026-109618 — Amazon Linux Security Center