Critical PHP2Shell: two unauthenticated RCE flaws in PHP itself. Fixes shipped on 21 Oct 2026. Check if you are affected →
日本語 Contact
← All news

PHP 8.1 Has Reached End of Life

PHP 8.1 stopped receiving security fixes on 31 December 2025. As PHP2Shell shows, unsupported branches now get no upstream patches for new vulnerabilities.

According to the official PHP supported-versions schedule, PHP 8.1 reached end of life on 31 December 2025. Since then the PHP project no longer ships security fixes for the 8.1 branch, joining 8.0, 7.x and older.

Why it matters now

The October 2026 PHP2Shell vulnerabilities (CVE-2026-109618 / CVE-2026-109619) were fixed upstream only for PHP 8.2 through 8.5. Branches from 5.4 to 8.1 received no upstream fix; national security agencies advise running them only with vendor-backported packages or migrating to a supported release.

Your options

  • Upgrade to a supported branch (8.2 or newer; 8.4/8.5 give the longest runway).
  • Use backported packages from your Linux distribution or an LTS vendor, if available for your platform.
  • Isolate and harden legacy apps while a migration is in progress.

Check your production, staging and any appliances or containers that bundle PHP – old runtimes are often hiding there.

Source: php.net supported versions

RescuePHP specialises in exactly this situation: backporting security fixes to EOL PHP and upgrading legacy code to a supported version.