WordPress on PHP 8.2? Plan your upgrade before December 31, 2026

If your WordPress website runs PHP 8.2, plan a move to PHP 8.3 or newer before December 31, 2026. That's the day PHP 8.2, one version of the software WordPress runs on behind the scenes, stops getting security fixes, and WordPress already recommends 8.3 or newer. The switch itself is usually a job for the company you pay to keep your website online. Your part is the plan: a backup, a test copy, a check of your theme and plugins, and a date in writing.

What ends on December 31?

Each PHP version gets fixes for a set time. Here's php.net's schedule as of October 21, 2026:

Sources: php.net supported versions and php.net end of life list.

PHP's October 21 release notes put it plainly: "PHP 8.2 reaches end of life on 31 December 2026 and will receive no further security fixes after that date. Please plan your upgrade to a supported version" (php.net).

What does end of life mean for your website?

Nothing switches off on January 1, and your website keeps running. It just stops getting fixes: if a new security bug in PHP turns up after December 31, the PHP project won't release a fixed version of 8.2.

October 21 showed what that looks like. The PHP project fixed two critical security bugs that day and released fixed versions of 8.2 and newer, but not of 8.1 or older, which "no longer receive updates from the PHP project" (php.net). Websites on those versions had to count on their hosting company getting a fix from somewhere else. A website still on 8.2 after December 31 will be in the same spot.

Of the WordPress sites that report their PHP version to WordPress.org, 23.8% were on PHP 8.2 and 36.4% were on 8.1 or older as of October 21, 2026 (WordPress.org stats). That's not a count of unprotected websites, because some hosting companies add fixes to older versions themselves.

If your website is on 8.2 today, the October 21 fix comes first and the upgrade second. Ask your hosting company whether you're on 8.2.35 or have an equivalent fix from them. For what to check, see our WordPress advisory page.

Why move to 8.3 or newer?

WordPress recommends "PHP version 8.3 or greater" (WordPress.org).

Which one to pick depends on your theme and plugins. WordPress itself supports a range of PHP versions (WordPress compatibility table), but an older theme or plugin may not work on the newest. We'd go with the newest version that passes your test.

How do you plan the upgrade?

A few notes from WordPress.org's own guide to updating PHP:

• The backup is your way back. WordPress.org says it "will let you revert your site to how it is right now in the event anything goes wrong," and that you'll also need your web host to move your PHP version back.

• Update WordPress, your theme, and your plugins first, then check them for PHP compatibility. If one has problems, WordPress.org suggests asking its developer or finding a replacement with similar features. That's about compatibility only: updating WordPress, plugins, or themes doesn't install the October 21 fix (WordPress.org).

• After the switch, test what your customers use: the phone number link, the booking form, and your main service pages. Send yourself a test request and make sure it arrives.

If you run a heating and air business, don't schedule this for the morning after the first hard freeze. Pick a slow afternoon, with someone ready to test the booking form.

What do you send your hosting company?

The two CVE numbers below are the official IDs for the October 21 bugs, so one message covers the urgent question and the planning one.

Subject: Moving [yourdomain.com] to PHP 8.3 or newer

Hello, my site [yourdomain.com] runs on your hosting. PHP 8.2 stops getting security fixes on December 31, 2026, so I'd like to plan a move to PHP 8.3 or newer. Please tell me, in writing:
1. Which PHP version my site uses now, and whether it includes the October 21 fix for CVE-2026-109618 and CVE-2026-109619.
2. Which newer PHP versions my plan offers.
3. Whether my plan includes a staging copy I can test on first.
4. How backups and a switch back to my current version would work if something breaks.
5. Whether you plan to move sites off PHP 8.2 yourselves, and when.
Thank you.
[Your name], [account email or account number]

On PHP 8.1 or older, follow the same plan, only sooner.

Who is The Graphite Lab?

The websites we build don't run PHP or WordPress, so these two bugs have nothing to attach to. There are no plugins to keep updated and no WordPress login page for anyone to guess passwords on. If you decide it's time for a new website, the first draft is ready for your review within 10 business days of payment.