Running an old PHP version: what the risk actually is

By Rob Sherwood, co-founder of Dev Partners · Published 25 October 2026 · Last reviewed 25 October 2026

What "end of life" actually means

Each version of PHP gets security fixes for a set number of years, then stops. The software doesn't break on that date. Your site carries on exactly as before, which is why so many businesses never notice. What changes is that nobody is fixing it any more.

PHP's own published dates, as at October 2026. 8.2 has about two months left.

"But it works"

Working and safe are different things. An old version works right up until the day it doesn't matter that it works.

In October 2026 details of a critical PHP flaw leaked, the kind that lets someone run their own code on your server. The official fix came out a day later, for the newest versions only. Anyone on an older version had no fix coming, ever. We had a stop-gap on every server we look after before the fix was even out, and every site it didn't cover rebuilt on supported PHP the same night. That story is here. Plenty of sites had nobody doing that for them.

The other costs of staying put

• Libraries move on. Payment providers, email services and the code your site depends on gradually stop supporting old PHP, so things break one at a time.
• Developers get harder to find. Fewer people want to work on old code, and the ones who do charge for the risk.
• The jump gets bigger. Moving one version is a job. Moving five is a project.
• Some buyers ask. Security questionnaires and Cyber Essentials both care about unsupported software.

What to do about it

Find out what you're on. Ask whoever hosts it, or whoever last worked on it. If nobody knows, that's an answer in itself.

If it's out of support, you have three real options: upgrade the code to a supported version (what that involves), move it to a new server at the same time (how to do that safely), or, if it's really not worth it, replace it. Some Linux distributions sell extended security support for older PHP, which can buy you time, but it's a bridge, not a destination.

Not sure which applies? A System Review tells you in writing what you're running, what's exposed, and a fixed price for each fix. £250 + VAT, five working days.

← Old software nobody will touch: keep, fix or replace