On 31 December 2026 PHP 8.2 stops receiving security fixes. That is the date on the calendar. The date that matters to a business is usually a few weeks either side of it: the morning a host forces the runtime up and the application stops responding, or the afternoon an insurance renewal form asks whether any unsupported software is in use. This post puts the two together for a Laravel application, with the dates taken from the PHP and Laravel release calendars and the prices taken from our own published list.
What ends on 31 December 2026
PHP 8.2 was released on 8 December 2022. Active support ended on 31 December 2024; since then it has received security fixes only. From 31 December 2026 it receives nothing. A vulnerability found in January 2027 is patched in 8.3, 8.4 and 8.5, and left open in 8.2.
For context, PHP 8.1 reached the same point on 31 December 2025. PHP 8.3 follows on 31 December 2027 and PHP 8.4 on 31 December 2028. The branch an application is pinned to decides how often this happens to it.
Who this affects
Every Laravel application whose server runs PHP 8.2, which in practice means most applications on Laravel 10 and Laravel 11 that were never moved on. The two problems compound:
- Laravel 10 stopped receiving security fixes on 4 February 2025. It supports PHP 8.1–8.3, so the natural move for a Laravel 10 app was PHP 8.2 or 8.3, and many stopped at 8.2.
- Laravel 11 stopped receiving security fixes on 12 March 2026. It supports PHP 8.2–8.4.
- Laravel 12 stopped receiving bug fixes on 13 August 2026 and keeps security fixes until 24 February 2027. It supports PHP 8.2–8.5, so a Laravel 12 app can move to PHP 8.4 or 8.5 without a framework upgrade.
- Laravel 13 is the current release, with bug fixes until 10 August 2027, and requires PHP 8.3+.
An application on Laravel 10 and PHP 8.2 therefore has an unpatched framework today and an unpatched runtime from 31 December 2026. Moving the PHP version alone is not available to it, because Laravel 10 does not run on PHP 8.4. The framework and the runtime move together, which is what an upgrade sprint is.
What forces the date
Which Laravel version is your app on?
Paste your composer.json into the free audit. Within 24 hours you get the end-of-life dates, the abandoned packages, and a fixed price for bringing it current.
The release calendar is advisory. Three things outside it are not, and each one is quoted from its source rather than paraphrased.
Cyber Essentials v3.2 (April 2025)
All software on in-scope devices must: be licensed and supported; removed from devices when it becomes unsupported or removed from scope by using a defined sub-set that prevents all traffic to / from the internet; have automatic updates enabled where possible; be updated, including vulnerability fixes, within 14 days of release, where the update fixes vulnerabilities described by the vendor as 'critical' or 'high' risk
Bespoke application code is out of Cyber Essentials scope, but the PHP runtime and operating system on an internet-facing server are not. A Laravel app pinned to an end-of-life PHP branch fails the certification through its server.
Source, checked 16 October 2026.
Cyber insurance renewal
Use of any outdated or unsupported software or systems
Listed among the exclusions on Hiscox UK's cyber and data insurance policy. Policies are re-assessed every twelve months, so the renewal questionnaire is usually where an owner first meets the version problem. The UK Cyber Security Breaches Survey 2025 found 62% of small and 65% of medium businesses hold cyber insurance.
Source, checked 16 October 2026.
Your host retires the PHP version
If your project uses a retired version, you must update to a supported version.
Upsun (Platform.sh) lists PHP 8.1 and older as retired and 8.2 and 8.3 as deprecated. Ubuntu 20.04, which shipped PHP 7.4, left standard support in May 2025. Shared hosts force the runtime change on their own schedule, and the application breaks on their date rather than yours.
Source, checked 16 October 2026.
What an upgrade costs
We publish our prices, and they apply whether you come to us directly or through your agency.
- Upgrade Sprint, $2,500 (£1,900), 7–10 working days. One or two Laravel versions and the matching PHP move, delivered on a branch with your test suite green and staging sign-off before production.
- Full Upgrade, $4,500–$6,000 (£3,400–£4,500), 2–3 weeks. Several versions with the PHP jump, abandoned packages replaced, tests backfilled where they are missing.
- Care plan from $500/month. 6 engineer-hours a month on the Essentials plan, so the next end-of-life date is a routine release rather than a project.
Which one applies depends on how far behind the application is, and the free audit tells you that from the composer.lock alone.
What to do this quarter
- Find the PHP version the server runs. On the server,
php -v; on a host's control panel, the PHP selector. The version incomposer.jsonis only the oldest the app allows, not what it runs on. - Find the Laravel version in
composer.lockunderlaravel/framework. - If either is behind the dates above, book the upgrade before the host or the insurer books it for you. December is the busiest month for this work, because everyone reads the same calendar in November.
- If both are current, put the next date in the calendar now: PHP 8.3 on 31 December 2027, Laravel 12 security on 24 February 2027.
Find out where your app stands
Send us the composer.lock on the free Laravel audit page. You get a written report within 24 hours: the PHP and Laravel versions you are on, the date each stops receiving fixes, the packages that block the jump, and a fixed price to bring it current. No call needed. The full cost guide shows the working behind every price.
Frequently asked questions
Our host still offers PHP 8.2. Does the date still apply?
Yes. A host offering a version is not the same as the version receiving fixes. Some hosts backport security patches for a period; most do not say which patches, and an insurer or certifier reads the PHP project's own calendar.
Can we move PHP without touching Laravel?
Only within the PHP range your Laravel version supports. Laravel 10 does not run on PHP 8.4; Laravel 11 and 12 do. The audit report states the range for your exact version.
Is this the same for Symfony, CodeIgniter or plain PHP?
The PHP date is identical for every framework. The framework support windows differ, and we quote only Laravel upgrades.
We have an in-house developer. Why would we use you?
Most of our upgrade clients have one. An upgrade is a fixed, bounded piece of work that competes with their feature roadmap, and a fixed price with a date beats a quarter of evenings. We hand over notes your developer can read, and the care plan is optional.
