Updated 21 October 2026.
PHP released a critical security release on 21 October 2026 (PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35). It fixes two vulnerabilities that can allow unauthenticated remote code execution. Read the full steps in our PHP critical security update guide.
Supported PHP versions
Dates are taken from the supported-versions page on php.net, as checked on 21 October 2026.
| PHP branch | Status (21 Oct 2026) | Security support until | Latest release |
|---|---|---|---|
| 8.5 | Active support | 31 Dec 2029 | 8.5.12 (21 Oct 2026) |
| 8.4 | Active support (until 31 Dec 2026) | 31 Dec 2028 | 8.4.27 (21 Oct 2026) |
| 8.3 | Security fixes only | 31 Dec 2027 | 8.3.36 (21 Oct 2026) |
| 8.2 | Security fixes only (until 31 Dec 2026) | 31 Dec 2026 | 8.2.35 (21 Oct 2026) |
| 8.1 and older | End of life | None | Upgrade |
Active support means bug fixes and security fixes. Security fixes only means the branch gets only security releases. After the security date, the branch gets nothing, so any new vulnerability stays open.
Which version should you use?
- New sites: PHP 8.4 or 8.5, if your application supports it.
- Existing sites: the newest version your application and plugins support. PHP 8.3 is a safe choice for most WordPress and Joomla sites today.
- Sites on PHP 8.2: plan the move before 31 December 2026.
- Sites on 8.1 or older: upgrade now. They run without security fixes.
Check which versions your server and sites use
In WHM, open Software > MultiPHP Manager. It lists every domain with its PHP version and the server default. Over SSH:
# PHP versions installed through EasyApache 4
whmapi1 php_get_installed_versions
# PHP version used by each domain
whmapi1 php_get_vhost_versions | grep -E "vhost|version"
# Exact release of one version
/opt/cpanel/ea-php84/root/usr/bin/php -v
Account owners can see and change their own version in cPanel under Software > MultiPHP Manager, or in Select PHP Version on CloudLinux servers.
Install a newer PHP version
- In WHM, open Software > EasyApache 4.
- Click Customize on the current profile.
- Open PHP Versions and tick the new version, for example
ea-php84. - Open PHP Extensions and add the extensions your sites need for the new version, such as mysqlnd, gd, intl, mbstring, xml, zip and opcache.
- Review and provision the changes.
For CloudLinux servers, see our PHP Selector guide.
Move a site to the new version
- ✓ Read the migration notes for the target version on php.net, especially removed and deprecated features.
- ✓ Check that your CMS, theme and plugins support the new version.
- ✓ Take a backup of the files and database.
- ✓ Test on a staging copy, or switch during a quiet time.
- ✓ Switch the version in MultiPHP Manager, then open the main pages and check the error log.
- ✓ Copy custom settings, such as memory_limit and upload limits, in MultiPHP INI Editor for the new version.
Keep PHP up to date
EasyApache 4 PHP packages update with the normal system updates. Make sure updates run, and restart PHP-FPM after security releases. When a critical release comes out, follow the steps in our PHP security update guide.
dnf update "ea-php*"
/scripts/restartsrv_apache_php_fpm
Remove versions you no longer use
Once no domain uses an old version, untick it in EasyApache 4. Fewer installed versions means fewer packages to patch. MultiPHP Manager shows whether any domain still uses a version before you remove it.
PHP 8.6
PHP 8.6 is in the release-candidate stage and is not for production use. Wait for the final release, then test it on a staging copy first.
Need help with this?
Need help moving your sites to a supported PHP version? Our team can test and upgrade them for you.
Frequently asked questions
Which PHP versions are supported in October 2026?
PHP 8.5, 8.4, 8.3 and 8.2. PHP 8.2 reaches end of life on 31 December 2026, and 8.1 and older are already end of life.
How do I change the PHP version of my site in cPanel?
Open MultiPHP Manager in cPanel, tick the domain, choose the version and click Apply. On CloudLinux, use Select PHP Version.
Will upgrading PHP break my website?
It can, if the site uses code that the new version removed. Check your application’s requirements and test on a copy first.
What happens when a PHP version reaches end of life?
It no longer receives security fixes, so new vulnerabilities stay open. Move your sites to a supported version.
How do I install PHP 8.5 on cPanel?
In WHM, open EasyApache 4, customise the profile, tick ea-php85 under PHP Versions, add the extensions you need, and provision.
Related guides
- How to Manage PHP Versions Using cPanel’s MultiPHP Manager
- PHP Critical Security Update (October 2026): Patch Guide, CloudLinux Status, CERT-EU Advice and Mitigations
- How to Optimize PHP Performance in cPanel with MultiPHP Manager & CloudLinux PHP Selector
- Optimizing PHP Performance in CloudLinux with PHP Selector: A Developer’s Guide
- Optimizing PHP Performance in CloudLinux with PHP Selector
