PHP 8.x — End of Life
Active Critical risk EOL: Dec 31, 2029in 1301d6 releases in this series36 CVEs
PHP 8.x — All releases
| Version | Released | Active support | EOL date | Latest patch | Status |
|---|---|---|---|---|---|
| 8.5 | Nov 20, 2025 | Dec 31, 2027 | Dec 31, 2029 | 8.5.7 | Active |
| 8.4 | Nov 21, 2024 | Dec 31, 2026 | Dec 31, 2028 | 8.4.22 | Active |
| 8.3 | Nov 23, 2023 | Dec 31, 2025 | Dec 31, 2027 | 8.3.31 | Active |
| 8.2 | Dec 8, 2022 | Dec 31, 2024 | Dec 31, 2026 | 8.2.31 | Active |
| 8.1 | Nov 25, 2021 | Nov 25, 2023 | Dec 31, 2025 | 8.1.34 | EOL |
| 8.0 | Nov 26, 2020 | Nov 26, 2022 | Nov 26, 2023 | 8.0.30 | EOL |
CVEs affecting PHP 8.x (36)
| CVE | Severity | CVSS | EPSS | KEV | Cycle | Description | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-14179 | CRITICAL | 9.8 | 0.07% | — | 8.2 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird … | May 10, 2026 |
| CVE-2025-14179 | CRITICAL | 9.8 | 0.07% | — | 8.4 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird … | May 10, 2026 |
| CVE-2026-7261 | CRITICAL | 9.8 | 0.10% | — | 8.3 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer i… | May 10, 2026 |
| CVE-2026-7261 | CRITICAL | 9.8 | 0.10% | — | 8.2 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer i… | May 10, 2026 |
| CVE-2025-14179 | CRITICAL | 9.8 | 0.07% | — | 8.5 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird … | May 10, 2026 |
| CVE-2026-6722 | CRITICAL | 9.8 | 0.37% | — | 8.2 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extensio… | May 10, 2026 |
| CVE-2026-6722 | CRITICAL | 9.8 | 0.37% | — | 8.3 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extensio… | May 10, 2026 |
| CVE-2026-6722 | CRITICAL | 9.8 | 0.37% | — | 8.4 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extensio… | May 10, 2026 |
| CVE-2026-6722 | CRITICAL | 9.8 | 0.37% | — | 8.5 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extensio… | May 10, 2026 |
| CVE-2026-7261 | CRITICAL | 9.8 | 0.10% | — | 8.4 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer i… | May 10, 2026 |
| CVE-2025-14179 | CRITICAL | 9.8 | 0.07% | — | 8.3 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird … | May 10, 2026 |
| CVE-2026-7261 | CRITICAL | 9.8 | 0.10% | — | 8.5 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer i… | May 10, 2026 |
| CVE-2026-6104 | CRITICAL | 9.1 | 0.03% | — | 8.5 | In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is pas… | May 10, 2026 |
| CVE-2026-6104 | CRITICAL | 9.1 | 0.03% | — | 8.4 | In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is pas… | May 10, 2026 |
| CVE-2026-7258 | HIGH | 7.5 | 0.03% | — | 8.3 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, i… | May 10, 2026 |
| CVE-2026-7258 | HIGH | 7.5 | 0.03% | — | 8.2 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, i… | May 10, 2026 |
| CVE-2026-7258 | HIGH | 7.5 | 0.03% | — | 8.4 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, i… | May 10, 2026 |
| CVE-2026-7258 | HIGH | 7.5 | 0.03% | — | 8.5 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, i… | May 10, 2026 |
| CVE-2026-7262 | HIGH | 7.5 | 0.12% | — | 8.4 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP serve… | May 10, 2026 |
| CVE-2026-7262 | HIGH | 7.5 | 0.12% | — | 8.5 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP serve… | May 10, 2026 |
| CVE-2026-7568 | HIGH | 7.5 | 0.09% | — | 8.2 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() f… | May 10, 2026 |
| CVE-2026-7568 | HIGH | 7.5 | 0.09% | — | 8.3 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() f… | May 10, 2026 |
| CVE-2026-7568 | HIGH | 7.5 | 0.09% | — | 8.4 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() f… | May 10, 2026 |
| CVE-2026-7568 | HIGH | 7.5 | 0.09% | — | 8.5 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() f… | May 10, 2026 |
| CVE-2026-7263 | HIGH | 7.5 | 0.05% | — | 8.4 | In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly,… | May 10, 2026 |
| CVE-2026-7263 | HIGH | 7.5 | 0.05% | — | 8.5 | In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly,… | May 10, 2026 |
| CVE-2026-7262 | HIGH | 7.5 | 0.12% | — | 8.2 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP serve… | May 10, 2026 |
| CVE-2026-7262 | HIGH | 7.5 | 0.12% | — | 8.3 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP serve… | May 10, 2026 |
| CVE-2026-7259 | MEDIUM | 6.5 | 0.08% | — | 8.4 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch betwee… | May 10, 2026 |
| CVE-2026-7259 | MEDIUM | 6.5 | 0.08% | — | 8.5 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch betwee… | May 10, 2026 |
| CVE-2026-7259 | MEDIUM | 6.5 | 0.08% | — | 8.3 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch betwee… | May 10, 2026 |
| CVE-2026-7259 | MEDIUM | 6.5 | 0.08% | — | 8.2 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch betwee… | May 10, 2026 |
| CVE-2026-6735 | MEDIUM | 6.1 | 0.08% | — | 8.5 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanit… | May 10, 2026 |
| CVE-2026-6735 | MEDIUM | 6.1 | 0.08% | — | 8.4 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanit… | May 10, 2026 |
| CVE-2026-6735 | MEDIUM | 6.1 | 0.08% | — | 8.3 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanit… | May 10, 2026 |
| CVE-2026-6735 | MEDIUM | 6.1 | 0.08% | — | 8.2 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanit… | May 10, 2026 |
Frequently asked questions
Is PHP 8 end of life?
Partially. Some PHP 8.x releases have reached EOL. Check the version table above for the exact status of each sub-release.
What CVEs affect PHP 8?
There are 36 CVEs tracked for PHP 8.x, including 14 critical severity issues. See the full list above with CVSS and EPSS scores.
What is the latest PHP 8 version?
The latest PHP 8.x patch release is 8.5.7, released on June 4, 2026. Always run the latest patch to benefit from all security fixes.
When was PHP 8 first released?
PHP 8.0 was initially released on November 20, 2025. See the full version timeline in the table above.
Is it safe to run PHP 8 in production?
PHP 8 is still supported and safe for production use until December 31, 2029. Ensure you are running the latest patch version (8.5.7) to have all security fixes applied.
Data sourced from endoflife.date · CVE data from NVD · EPSS from FIRST.org · KEV from CISA