- Home
- PHP EOL Dates
- PHP 8.2
PHP 8.2 End of Life
PHP 8.2 gets its last security fixes on December 31, 2026. Here is what that means for your sites, and how to move to PHP 8.3, 8.4 or 8.5 without surprises.
Security support ends on Dec 31, 2026
of PHP websites run 8.2
(W3Techs, Oct 26, 2026)
What PHP 8.2 end of life means
PHP 8.2 was released on December 8, 2022. Its two years of active support ended on December 31, 2024, and since then it has only received security fixes, including the October 21, 2026 release 8.2.35 that fixed the critical PHP2Shell vulnerabilities. On December 31, 2026 that stops: from January 1, 2027, no vulnerability found in PHP 8.2 will be fixed by the PHP project.
That is a lot of websites. According to W3Techs, PHP 8.2 runs on about 18% of all PHP sites, and once it reaches end of life, roughly two thirds of the PHP web will be on an unsupported version. Your site will keep working on January 1, but every month after that adds risk, and plugins, frameworks and Composer packages will gradually drop 8.2 from their requirements.
The good news: 8.2 to 8.3 or 8.4 is one of the easiest upgrades PHP has had. There are no large breaking changes, only deprecations that you can find and fix in advance.
What PHP 8.2 added
The features that made 8.2 worth adopting. Each example opens in the sandbox on PHP 8.2; switch to PHP 8.1 to see it fail.
Readonly classes
Mark a whole class readonly and every property becomes readonly, perfect for value objects and DTOs.
<?php
readonly class Money
{
public function __construct(
public int $amount,
public string $currency,
) {}
}
$price = new Money(1999, 'USD');
echo $price->amount, ' ', $price->currency, PHP_EOL;
try {
$price->amount = 0;
} catch (Error $e) {
echo get_class($e), ': ', $e->getMessage();
}
Run on PHP 8.2 →DNF types
Combine union and intersection types, written in Disjunctive Normal Form: (A&B)|null.
<?php
interface HasId { public function id(): int; }
interface HasName { public function name(): string; }
class User implements HasId, HasName {
public function id(): int { return 7; }
public function name(): string { return 'Ada'; }
}
function label((HasId&HasName)|null $x): string
{
return $x ? "#{$x->id()} {$x->name()}" : 'nobody';
}
echo label(new User), PHP_EOL, label(null);
Run on PHP 8.2 →The Random extension
An object-oriented API for random numbers with swappable engines, including seedable ones for reproducible tests.
<?php
use Random\Randomizer;
use Random\Engine\Xoshiro256StarStar;
$r = new Randomizer(new Xoshiro256StarStar(42)); // seeded: same output every run
echo $r->getInt(1, 100), PHP_EOL;
echo implode(', ', $r->shuffleArray(['a', 'b', 'c', 'd'])), PHP_EOL;
echo bin2hex((new Randomizer())->getBytes(8)); // secure by default
Run on PHP 8.2 →true, false and null as types
Use null, false and true as standalone types, and constants in traits.
<?php
trait Versioned
{
public const VERSION = '8.2';
}
class Api
{
use Versioned;
public function isLegacy(): false
{
return false;
}
}
echo Api::VERSION, PHP_EOL;
var_dump((new Api)->isLegacy());
Run on PHP 8.2 →What changes when you upgrade from PHP 8.2
Nothing below breaks a site on day one; they are deprecations and small behaviour changes. Run each example on 8.2 and on the newer version to see the difference.
Implicitly nullable parameters are deprecated (8.4)
A parameter with a type and a default of null, like Type $x = null, now raises a deprecation. Write ?Type $x = null. This is the most common warning after an upgrade to 8.4, and tools like PHP-CS-Fixer fix it automatically.
<?php
function greet(string $name = null)
{
return 'Hello ' . ($name ?? 'world');
}
echo greet();
Typed class constants and #[\Override] (8.3)
Class constants can declare a type, and the #[\Override] attribute makes PHP check that a method really overrides a parent method. Both are opt-in, so existing code is unaffected.
<?php
class Base
{
public const string NAME = 'base';
public function render(): string { return static::NAME; }
}
class Child extends Base
{
public const string NAME = 'child';
#[\Override]
public function render(): string { return strtoupper(parent::render()); }
}
echo (new Child)->render();
Extensions removed from core (8.4)
IMAP, OCI8, PDO_OCI and Pspell moved from the PHP source to PECL. If you read mailboxes with imap_open(), install the PECL extension or move to a library such as webklex/php-imap before upgrading.
E_USER_ERROR and other small deprecations (8.4)
Calling trigger_error() with E_USER_ERROR is deprecated (throw an exception instead), as are the E_STRICT constant and a few rarely used functions. Run your test suite with error_reporting(E_ALL) on the new version to catch them.
How to upgrade from PHP 8.2
- Find every site on 8.2. Check public sites with the PHP Version Checker and the rest with
php -vor your hosting panel. - Pick the target. PHP 8.4 is supported until December 31, 2028 and PHP 8.5 until December 31, 2029. Jumping straight to 8.4 or 8.5 saves you another upgrade next year.
- Update dependencies first. Update WordPress core, plugins and themes, or run
composer update, while still on 8.2. Check that each major package supports your target version. - Turn on all deprecations on staging. Set
error_reporting = E_ALLon a staging copy running the new version and click through the site. Deprecations tell you exactly what to fix, file and line included. - Fix nullable parameters automatically. Run
php-cs-fixer fix --rules=nullable_type_declaration_for_default_null_valueor Rector's PHP 8.4 set. - Switch production and watch the log. Most hosts let you switch the version per site and switch back in one click. Keep an eye on the error log for a few days.
Not sure whether a piece of code survives the upgrade? The code compatibility checker runs it on PHP 7.4 through 8.5 at once and shows the errors and deprecations for each version. For dates of every other version, see the PHP EOL table.
Free PHP tools
PHP Version Checker
Find the PHP version of any website, or which versions your code runs on.
PHP Sandbox
Write and run PHP 7.4 to 8.5 in your browser. Nothing to install.
PHP Syntax Checker
Find parse errors with the exact line, checked by the real PHP parser.
PHP EOL Dates
Support and end-of-life dates for every PHP version, with countdowns.
Bcrypt Generator
Hash and verify passwords in the format PHP's password_hash() uses.
phpinfo() Analyzer
Paste phpinfo() output and see risky settings and outdated versions.
PHP Date Format
Every date() format character with a live preview of your format string.
PHP Formatter
Beautify PHP code to the PSR-12 style in one click.
PHP Regex Tester
Test preg_match, preg_replace and preg_split with real PHP PCRE.
PHP Unserialize
Turn serialized PHP data into a readable tree, JSON or print_r.
JSON to PHP Array
Convert JSON to a PHP array and PHP arrays back to JSON.
Frequently asked questions
When is PHP 8.2 end of life?
December 31, 2026. Active support ended on December 31, 2024; since then PHP 8.2 has only received security fixes, and after December 31, 2026 it receives none.
Is PHP 8.2 still safe to use?
Until the end of 2026, yes, as long as you run the latest patch release, 8.2.35 or newer, which includes the October 2026 PHP2Shell fixes. From 2027, new vulnerabilities will not be fixed, so plan the upgrade now.
Should I upgrade from PHP 8.2 to 8.3 or 8.4?
Go to 8.4 or 8.5 if your applications support it. PHP 8.3 itself reaches end of life on December 31, 2027, so it only buys one year. The extra changes between 8.3 and 8.4 are mostly deprecations.
Does WordPress work on PHP 8.4?
Current WordPress versions support PHP 8.4, and most popular plugins do. Older or abandoned plugins are the usual problem. Test on a staging copy with debugging enabled, and replace plugins that are no longer maintained.
What happens if I stay on PHP 8.2 after 2026?
The site keeps running. What you lose is protection: new security bugs stay open, hosts start charging for or removing old versions, and plugin and package updates stop installing. Some Linux distributions backport fixes for their own PHP 8.2 packages longer; check your distribution's security tracker.