PHP 7.x — End of Life
EOL Critical riskPHP 7.x reached end of life on Nov 28, 2022, 1425 days ago, and no longer receives security fixes. The most recent release in this series is 7.4.33. 6 CVEs are tracked for this series, including 1 critical. 1 of them was published after the end of life of the affected cycle and will not get an official patch. The next major version is PHP 8. See PHP 8 →
PHP 7.x — All releases
| Version | Released | Active support | EOL date | Latest patch | Status | Alert me |
|---|---|---|---|---|---|---|
| 7.4 | Nov 28, 2019 | Nov 28, 2021 | Nov 28, 2022 | 7.4.33 | EOL | |
| 7.3 | Dec 6, 2018 | Dec 6, 2020 | Dec 6, 2021 | 7.3.33 | EOL | |
| 7.2 | Nov 30, 2017 | Nov 30, 2019 | Nov 30, 2020 | 7.2.34 | EOL | |
| 7.1 | Dec 1, 2016 | Dec 1, 2018 | Dec 1, 2019 | 7.1.33 | EOL | |
| 7.0 | Dec 3, 2015 | Jan 4, 2018 | Jan 10, 2019 | 7.0.33 | EOL |
CVEs affecting PHP 7.x (19)
| CVE | Severity | CVSS | EPSS | KEV | Cycle | Description | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-3566 | CRITICAL | 9.8 | 6.82% | — | 7.2 | A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly d… | Apr 10, 2024 |
| CVE-2024-3566 | CRITICAL | 9.8 | 6.82% | — | 7.3 | A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly d… | Apr 10, 2024 |
| CVE-2024-3566 | CRITICAL | 9.8 | 6.82% | — | 7.4 | A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly d… | Apr 10, 2024 |
| CVE-2024-3566 | CRITICAL | 9.8 | 6.82% | — | 7.0 | A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly d… | Apr 10, 2024 |
| CVE-2024-3566 | CRITICAL | 9.8 | 6.82% | — | 7.1 | A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly d… | Apr 10, 2024 |
| CVE-2019-11050 | MEDIUM | 4.8 | 7.62% | — | 7.4 | When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7… | Dec 23, 2019 |
| CVE-2019-11050 | MEDIUM | 4.8 | 7.62% | — | 7.3 | When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7… | Dec 23, 2019 |
| CVE-2019-11050 | MEDIUM | 4.8 | 7.62% | — | 7.2 | When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7… | Dec 23, 2019 |
| CVE-2019-11049 | MEDIUM | 6.5 | 4.21% | — | 7.4 | In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail() function, due to mistak… | Dec 23, 2019 |
| CVE-2019-11049 | MEDIUM | 6.5 | 4.21% | — | 7.3 | In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail() function, due to mistak… | Dec 23, 2019 |
| CVE-2019-11046 | LOW | 3.7 | 4.11% | — | 7.3 | In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, includ… | Dec 23, 2019 |
| CVE-2019-11046 | LOW | 3.7 | 4.11% | — | 7.2 | In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, includ… | Dec 23, 2019 |
| CVE-2019-11046 | LOW | 3.7 | 4.11% | — | 7.4 | In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, includ… | Dec 23, 2019 |
| CVE-2019-11045 | LOW | 3.7 | 8.81% | — | 7.4 | In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with emb… | Dec 23, 2019 |
| CVE-2019-11045 | LOW | 3.7 | 8.81% | — | 7.3 | In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with emb… | Dec 23, 2019 |
| CVE-2019-11045 | LOW | 3.7 | 8.81% | — | 7.2 | In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with emb… | Dec 23, 2019 |
| CVE-2019-11044 | LOW | 3.7 | 5.12% | — | 7.3 | In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link() function accepts filenames with … | Dec 23, 2019 |
| CVE-2019-11044 | LOW | 3.7 | 5.12% | — | 7.2 | In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link() function accepts filenames with … | Dec 23, 2019 |
| CVE-2019-11044 | LOW | 3.7 | 5.12% | — | 7.4 | In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link() function accepts filenames with … | Dec 23, 2019 |
PHP 7.x is EOL — migrate to PHP 8.x
PHP 8.x is the next major release. Plan your upgrade before PHP 7.x stops receiving security patches.
Add a PHP 7 EOL badge to your README
Show your users which PHP version your project runs and whether it is still supported. The badge updates automatically. More formats and options →
[](https://eolcanary.com/explore/php/7)Frequently asked questions
Is PHP 7 end of life?
Yes. All PHP 7.x releases have reached end of life and no longer receive security patches. There are 6 known CVEs affecting PHP 7.x, including 1 critical. Migrate to PHP 8.x as soon as possible.
What CVEs affect PHP 7?
There are 6 CVEs tracked for PHP 7.x, including 1 critical severity issue. See the full list above with CVSS and EPSS scores.
What is the latest PHP 7 version?
The latest PHP 7.x patch release is 7.4.33, released on November 3, 2022. Always run the latest patch to benefit from all security fixes.
How to migrate from PHP 7 to PHP 8?
To migrate from PHP 7 to PHP 8: (1) review the official PHP 8 migration guide for breaking changes, (2) update dependencies and configuration accordingly, (3) test thoroughly in a staging environment, (4) deploy with a rollback plan. Starting early gives you time to resolve compatibility issues before your current version reaches end of life.
Is it safe to run PHP 7 in production?
No. PHP 7 has reached end of life and security vulnerabilities are no longer patched. Upgrade to a supported version immediately.
Data sourced from endoflife.date · CVE data from NVD · EPSS from FIRST.org · KEV from CISA