Where PHP stands in late 2026
PHP still runs most of the web. According to W3Techs, it is used by 69.3% of all websites whose server-side language is known. That makes version management a practical issue for a very large number of businesses.
The PHP support calendar
Each PHP release branch gets two years of active support, followed by two years of security-only fixes. After those four years, the branch reaches end of life and receives no further support.
| PHP version | Active support until | Security support until |
|---|---|---|
| 8.1 | Ended | 31 December 2025 (end of life) |
| 8.2 | Ended | 31 December 2026 |
| 8.3 | Ended | 31 December 2027 |
| 8.4 | 31 December 2026 | 31 December 2028 |
| 8.5 | 31 December 2027 | 31 December 2029 |
How much of the web runs on unsupported PHP
W3Techs data from 22 October 2026 shows that among PHP websites:
- 65.3% run version 8;
- 26.9% run version 7;
- 7.7% still run version 5.
Within PHP 8 sites, the most common minor versions are 8.3 at 34.9% and 8.2 at 27.6%, followed by 8.1 at 15.1%.
Combining the two snapshots gives a rough picture. About 48% of PHP websites already run a version that no longer receives official security fixes. If nothing changes, that share rises to about two thirds on 1 January 2027, when PHP 8.2 joins the list.
These are Cypherox estimates based on W3Techs snapshots from 22 and 23 October 2026. W3Techs measures a global sample of websites, not Germany specifically.
What end of life means for a business application
The first consequence is security. The PHP project warns that users of end-of-life releases may be exposed to unpatched security vulnerabilities. Any flaw disclosed after the cut-off date stays open on your servers.
Some Linux package maintainers and commercial vendors backport security fixes to end-of-life PHP versions. That can buy time, but it adds a dependency and a cost without moving your code forward.
The second consequence is the ecosystem. Frameworks drop support for older PHP versions on their own schedules. Laravel 11 stopped receiving security fixes on 12 March 2026, and Laravel 13 requires PHP 8.3 or newer. An old PHP version gradually locks you out of framework updates, libraries and the security fixes that come with them.
Three ways forward
1. Buy time with extended support
Extended security patches from a third party are a bridge, not a destination. They make sense when an upgrade is already planned and you need a few months of cover. Treat them as a cost with a fixed end date.
2. Upgrade in place
For many applications, moving to PHP 8.4 or 8.5 is a contained project. The work involves replacing deprecated functions, updating dependencies and fixing type and behaviour changes between versions.
Automated refactoring tools help here. Rector, for example, applies rule-based upgrades to PHP code and can show every proposed change in a dry run before anything is written. Its output still needs tests and human review.
3. Modernize in stages with the Strangler Fig pattern
Some applications are too tangled to upgrade cleanly. For those, the Strangler Fig approach, named by Martin Fowler, replaces the system gradually instead of all at once. New functionality is built alongside the legacy code, and behaviour moves across piece by piece.
In practice, a façade sits in front of the application and routes each request either to the legacy code or to the new service. Users keep the same interface while features migrate underneath. Once nothing routes to the old code, it can be retired.
The approach still takes real work. It needs temporary architecture so old and new can coexist, and the façade must not become a bottleneck or single point of failure. Its main advantage is that both the investment and the benefits arrive gradually and visibly.
When a full rewrite is justified
A rewrite makes sense when the existing code can no longer support how the business works, not simply because the code is old. It delivers value only at the end and carries the risk of missing behaviour the old system quietly handled. Choose it deliberately, not by default.
A staged modernization plan
- Take inventory.Record the PHP version, framework version, extensions and hosting environment for every application.
- Rank by risk.Prioritize public-facing applications and those handling customer or payment data.
- Build a safety net first.Add automated tests around critical business flows before changing anything.
- Upgrade dependencies.Move Composer packages and the framework to versions that support your target PHP version.
- Run automated refactoring.Apply Rector or similar tools in small, reviewable batches.
- Upgrade PHP in a staging environment.Test with production-like data, then release in stages.
- Decide on the hard parts.Where code resists upgrading, plan a Strangler Fig migration instead of forcing it.
- Put the next deadline in the calendar.PHP 8.3 security support ends on 31 December 2027, so plan your next upgrade now.
Framework and platform knock-on effects
Check the deadlines of everything that runs on top of PHP, not just PHP itself.
Laravel provides bug fixes for 18 months and security fixes for two years per major release. Laravel 12 receives security fixes until 24 February 2027, so many teams face a framework upgrade shortly after the PHP one. Planning both together saves a second round of testing.
Magento and Adobe Commerce also depend on specific PHP versions. Adobe Commerce 2.4.7 runs on PHP 8.2 and 8.3. Stores still on PHP 8.2 will hit the PHP deadline before Adobe's own end-of-support date for that release.
Staffing the work
Upgrades often stall because the internal team is busy keeping the application running. Ring-fenced capacity helps. That can be a project team that owns the whole upgrade, or developers who join your team for a set period.
Cypherox provides PHP developers who work in Laravel, Symfony, CodeIgniter and WordPress. They can take on existing codebases, migrate outdated PHP versions and clean up technical debt without starting from scratch. For Laravel-specific upgrades, see our Laravel developers.
If the application needs more than an upgrade, Cypherox's web development teams handle staged modernization projects. If you are unsure which path fits, our technology consulting team can assess your codebase before you commit. Online shops on Magento should also read up on Magento developers and platform upgrade planning.