Which PHP version is your system running, and until when does it get security fixes?
A ten-minute check you can run yourself, with the dates from php.net. If the answer worries you, a Health Check turns it into a plan: two days, read-only, EUR 1,080 excl. VAT, fixed.
The versions that are supported today
| Version | Released | Active support until | Security fixes until |
|---|---|---|---|
| 8.2 | 8 Dec 2022 | 31 Dec 2024 | 31 Dec 2026 |
| 8.3 | 23 Nov 2023 | 31 Dec 2025 | 31 Dec 2027 |
| 8.4 | 21 Nov 2024 | 31 Dec 2026 | 31 Dec 2028 |
| 8.5 | 20 Nov 2025 | 31 Dec 2027 | 31 Dec 2029 |
Source: php.net/supported-versions.php, read on 30 October 2026. A version that is not in this table no longer gets security fixes.
Check yours in ten minutes
- Ask the server. Run
php -von the command line, and look at what the website itself uses: the version on a phpinfo page can differ from the command line (php-fpm against CLI). Remove such a page afterwards. - Read composer.json. The
require.phpline says what the code expects; composer.lock shows what is really installed. - Run
composer audit. It lists installed packages with known security advisories (Composer 2.4 and newer). - Run
composer outdated --direct. It shows which direct dependencies are behind. - Look up your framework (Laravel, Symfony, Phalcon or whatever you run) on its own support page and note until when your major version gets fixes.
- Ask when a backup was last restored, not when it was made.
What the answer means
- Older than 8.2: no security fixes any more. Plan an upgrade, in steps and with a way back for each step.
- 8.2: security fixes until 31 December 2026. That is the coming months, so plan now.
- 8.3, 8.4 or 8.5: supported. Then look at the dependencies, because the weak spot is usually a package and not PHP itself.
From the answer to a plan
A Health Check lays the runtime, the database and the framework next to their official end-of-life dates, finds dependencies with known vulnerabilities, looks at how secrets are handled and where changing the code is risky, and ends in a written plan in steps with hours per item. Two days, read-only, fixed price EUR 1,080 excl. VAT (12 hours × EUR 90). A free intro call comes first.
What it covers and what it costs · A sample report
Who writes this
Stanislav Plotnikov, senior developer and solution architect in Eindhoven. I have been programming since the 2000s, PHP first. Scuttle Development exists since December 2024, KvK 96040947. You talk to the person who does the work.
Want me to look at it?
Tell me which version you run and what hurts. I reply within one working day with a first opinion, free.