PHP 7.x — End of Life
EOL Critical riskPHP 7.x — All releases
| Version | Released | Active support | EOL date | Latest patch | Status | Alert me |
|---|---|---|---|---|---|---|
| 7.4 | Nov 28, 2019 | Nov 28, 2021 | Nov 28, 2022 | 7.4.33 | EOL | |
| 7.3 | Dec 6, 2018 | Dec 6, 2020 | Dec 6, 2021 | 7.3.33 | EOL | |
| 7.2 | Nov 30, 2017 | Nov 30, 2019 | Nov 30, 2020 | 7.2.34 | EOL | |
| 7.1 | Dec 1, 2016 | Dec 1, 2018 | Dec 1, 2019 | 7.1.33 | EOL | |
| 7.0 | Dec 3, 2015 | Jan 4, 2018 | Jan 10, 2019 | 7.0.33 | EOL |
CVEs affecting PHP 7.x (19)
| CVE | Severity | CVSS | EPSS | KEV | Cycle | Description | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-3566 | CRITICAL | 9.8 | 6.88% | — | 7.2 | A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly d… | Apr 10, 2024 |
| CVE-2024-3566 | CRITICAL | 9.8 | 6.88% | — | 7.3 | A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly d… | Apr 10, 2024 |
| CVE-2024-3566 | CRITICAL | 9.8 | 6.88% | — | 7.4 | A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly d… | Apr 10, 2024 |
| CVE-2024-3566 | CRITICAL | 9.8 | 6.88% | — | 7.0 | A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly d… | Apr 10, 2024 |
| CVE-2024-3566 | CRITICAL | 9.8 | 6.88% | — | 7.1 | A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly d… | Apr 10, 2024 |
| CVE-2019-11050 | MEDIUM | 4.8 | 7.62% | — | 7.4 | When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7… | Dec 23, 2019 |
| CVE-2019-11050 | MEDIUM | 4.8 | 7.62% | — | 7.3 | When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7… | Dec 23, 2019 |
| CVE-2019-11050 | MEDIUM | 4.8 | 7.62% | — | 7.2 | When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7… | Dec 23, 2019 |
| CVE-2019-11049 | MEDIUM | 6.5 | 4.21% | — | 7.4 | In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail() function, due to mistak… | Dec 23, 2019 |
| CVE-2019-11049 | MEDIUM | 6.5 | 4.21% | — | 7.3 | In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail() function, due to mistak… | Dec 23, 2019 |
| CVE-2019-11046 | LOW | 3.7 | 4.08% | — | 7.3 | In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, includ… | Dec 23, 2019 |
| CVE-2019-11046 | LOW | 3.7 | 4.08% | — | 7.2 | In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, includ… | Dec 23, 2019 |
| CVE-2019-11046 | LOW | 3.7 | 4.08% | — | 7.4 | In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, includ… | Dec 23, 2019 |
| CVE-2019-11045 | LOW | 3.7 | 8.81% | — | 7.4 | In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with emb… | Dec 23, 2019 |
| CVE-2019-11045 | LOW | 3.7 | 8.81% | — | 7.3 | In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with emb… | Dec 23, 2019 |
| CVE-2019-11045 | LOW | 3.7 | 8.81% | — | 7.2 | In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with emb… | Dec 23, 2019 |
| CVE-2019-11044 | LOW | 3.7 | 5.12% | — | 7.3 | In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link() function accepts filenames with … | Dec 23, 2019 |
| CVE-2019-11044 | LOW | 3.7 | 5.12% | — | 7.2 | In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link() function accepts filenames with … | Dec 23, 2019 |
| CVE-2019-11044 | LOW | 3.7 | 5.12% | — | 7.4 | In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link() function accepts filenames with … | Dec 23, 2019 |
PHP 7.x is EOL — migrate to PHP 8.x
PHP 8.x is the next major release. Plan your upgrade before PHP 7.x stops receiving security patches.
Frequently asked questions
Is PHP 7 end of life?
Yes. All PHP 7.x releases have reached end of life and no longer receive security patches. There are 19 known CVEs affecting PHP 7.x, including 5 critical. Migrate to PHP 8.x as soon as possible.
What CVEs affect PHP 7?
There are 19 CVEs tracked for PHP 7.x, including 5 critical severity issues. See the full list above with CVSS and EPSS scores.
What is the latest PHP 7 version?
The latest PHP 7.x patch release is 7.4.33, released on November 3, 2022. Always run the latest patch to benefit from all security fixes.
How to migrate from PHP 7 to PHP 8?
To migrate from PHP 7 to PHP 8: (1) review the official PHP 8 migration guide for breaking changes, (2) update dependencies and configuration accordingly, (3) test thoroughly in a staging environment, (4) deploy with a rollback plan. Starting early gives you time to resolve compatibility issues before your current version reaches end of life.
Is it safe to run PHP 7 in production?
No. PHP 7 has reached end of life and security vulnerabilities are no longer patched. Upgrade to a supported version immediately.
Data sourced from endoflife.date · CVE data from NVD · EPSS from FIRST.org · KEV from CISA