1. Home
  2. PHP EOL Dates
  3. PHP 8.2

PHP 8.2 End of Life

PHP 8.2 gets its last security fixes on December 31, 2026. Here is what that means for your sites, and how to move to PHP 8.3, 8.4 or 8.5 without surprises.

Security fixes only
66 days left

Security support ends on Dec 31, 2026

17.9%

of PHP websites run 8.2
(W3Techs, Oct 26, 2026)

ReleasedDec 8, 2022Active support untilDec 31, 2024Security fixes untilDec 31, 2026Last release8.2.35

Check which PHP version your site runs

What PHP 8.2 end of life means

PHP 8.2 was released on December 8, 2022. Its two years of active support ended on December 31, 2024, and since then it has only received security fixes, including the October 21, 2026 release 8.2.35 that fixed the critical PHP2Shell vulnerabilities. On December 31, 2026 that stops: from January 1, 2027, no vulnerability found in PHP 8.2 will be fixed by the PHP project.

That is a lot of websites. According to W3Techs, PHP 8.2 runs on about 18% of all PHP sites, and once it reaches end of life, roughly two thirds of the PHP web will be on an unsupported version. Your site will keep working on January 1, but every month after that adds risk, and plugins, frameworks and Composer packages will gradually drop 8.2 from their requirements.

The good news: 8.2 to 8.3 or 8.4 is one of the easiest upgrades PHP has had. There are no large breaking changes, only deprecations that you can find and fix in advance.

What PHP 8.2 added

The features that made 8.2 worth adopting. Each example opens in the sandbox on PHP 8.2; switch to PHP 8.1 to see it fail.

Readonly classes

Mark a whole class readonly and every property becomes readonly, perfect for value objects and DTOs.

<?php
readonly class Money
{
    public function __construct(
        public int $amount,
        public string $currency,
    ) {}
}

$price = new Money(1999, 'USD');
echo $price->amount, ' ', $price->currency, PHP_EOL;

try {
    $price->amount = 0;
} catch (Error $e) {
    echo get_class($e), ': ', $e->getMessage();
}
Run on PHP 8.2 →

DNF types

Combine union and intersection types, written in Disjunctive Normal Form: (A&B)|null.

<?php
interface HasId { public function id(): int; }
interface HasName { public function name(): string; }

class User implements HasId, HasName {
    public function id(): int { return 7; }
    public function name(): string { return 'Ada'; }
}

function label((HasId&HasName)|null $x): string
{
    return $x ? "#{$x->id()} {$x->name()}" : 'nobody';
}

echo label(new User), PHP_EOL, label(null);
Run on PHP 8.2 →

The Random extension

An object-oriented API for random numbers with swappable engines, including seedable ones for reproducible tests.

<?php
use Random\Randomizer;
use Random\Engine\Xoshiro256StarStar;

$r = new Randomizer(new Xoshiro256StarStar(42)); // seeded: same output every run
echo $r->getInt(1, 100), PHP_EOL;
echo implode(', ', $r->shuffleArray(['a', 'b', 'c', 'd'])), PHP_EOL;
echo bin2hex((new Randomizer())->getBytes(8)); // secure by default
Run on PHP 8.2 →

true, false and null as types

Use null, false and true as standalone types, and constants in traits.

<?php
trait Versioned
{
    public const VERSION = '8.2';
}

class Api
{
    use Versioned;

    public function isLegacy(): false
    {
        return false;
    }
}

echo Api::VERSION, PHP_EOL;
var_dump((new Api)->isLegacy());
Run on PHP 8.2 →

What changes when you upgrade from PHP 8.2

Nothing below breaks a site on day one; they are deprecations and small behaviour changes. Run each example on 8.2 and on the newer version to see the difference.

Implicitly nullable parameters are deprecated (8.4)

A parameter with a type and a default of null, like Type $x = null, now raises a deprecation. Write ?Type $x = null. This is the most common warning after an upgrade to 8.4, and tools like PHP-CS-Fixer fix it automatically.

<?php
function greet(string $name = null)
{
    return 'Hello ' . ($name ?? 'world');
}
echo greet();

Run on PHP 8.2 →Run on PHP 8.4 →

Typed class constants and #[\Override] (8.3)

Class constants can declare a type, and the #[\Override] attribute makes PHP check that a method really overrides a parent method. Both are opt-in, so existing code is unaffected.

<?php
class Base
{
    public const string NAME = 'base';
    public function render(): string { return static::NAME; }
}

class Child extends Base
{
    public const string NAME = 'child';

    #[\Override]
    public function render(): string { return strtoupper(parent::render()); }
}

echo (new Child)->render();

Run on PHP 8.2 →Run on PHP 8.3 →

Extensions removed from core (8.4)

IMAP, OCI8, PDO_OCI and Pspell moved from the PHP source to PECL. If you read mailboxes with imap_open(), install the PECL extension or move to a library such as webklex/php-imap before upgrading.

E_USER_ERROR and other small deprecations (8.4)

Calling trigger_error() with E_USER_ERROR is deprecated (throw an exception instead), as are the E_STRICT constant and a few rarely used functions. Run your test suite with error_reporting(E_ALL) on the new version to catch them.

How to upgrade from PHP 8.2

  1. Find every site on 8.2. Check public sites with the PHP Version Checker and the rest with php -v or your hosting panel.
  2. Pick the target. PHP 8.4 is supported until December 31, 2028 and PHP 8.5 until December 31, 2029. Jumping straight to 8.4 or 8.5 saves you another upgrade next year.
  3. Update dependencies first. Update WordPress core, plugins and themes, or run composer update, while still on 8.2. Check that each major package supports your target version.
  4. Turn on all deprecations on staging. Set error_reporting = E_ALL on a staging copy running the new version and click through the site. Deprecations tell you exactly what to fix, file and line included.
  5. Fix nullable parameters automatically. Run php-cs-fixer fix --rules=nullable_type_declaration_for_default_null_value or Rector's PHP 8.4 set.
  6. Switch production and watch the log. Most hosts let you switch the version per site and switch back in one click. Keep an eye on the error log for a few days.

Not sure whether a piece of code survives the upgrade? The code compatibility checker runs it on PHP 7.4 through 8.5 at once and shows the errors and deprecations for each version. For dates of every other version, see the PHP EOL table.

Free PHP tools

Frequently asked questions

When is PHP 8.2 end of life?

December 31, 2026. Active support ended on December 31, 2024; since then PHP 8.2 has only received security fixes, and after December 31, 2026 it receives none.

Is PHP 8.2 still safe to use?

Until the end of 2026, yes, as long as you run the latest patch release, 8.2.35 or newer, which includes the October 2026 PHP2Shell fixes. From 2027, new vulnerabilities will not be fixed, so plan the upgrade now.

Should I upgrade from PHP 8.2 to 8.3 or 8.4?

Go to 8.4 or 8.5 if your applications support it. PHP 8.3 itself reaches end of life on December 31, 2027, so it only buys one year. The extra changes between 8.3 and 8.4 are mostly deprecations.

Does WordPress work on PHP 8.4?

Current WordPress versions support PHP 8.4, and most popular plugins do. Older or abandoned plugins are the usual problem. Test on a staging copy with debugging enabled, and replace plugins that are no longer maintained.

What happens if I stay on PHP 8.2 after 2026?

The site keeps running. What you lose is protection: new security bugs stay open, hosts start charging for or removing old versions, and plugin and package updates stop installing. Some Linux distributions backport fixes for their own PHP 8.2 packages longer; check your distribution's security tracker.