PHP

How PHP versioning, EOL & security support work

PHP releases a new version once a year, generally in November. Each branch then follows a fixed two-phase lifecycle: a period of full active support, followed by a period where only security fixes land, after which the branch is retired. Because active support and security-only support each run for a defined stretch and a new branch arrives yearly, several branches typically overlap in different phases at once.

PHP security issues are reported through the php-src security advisories on GitHub, or by emailing security@php.net. CVE numbers are assigned by the PHP security team itself, and details stay private until a fix and advisory are published. Because fixes are only backported to branches still in active or security support, an end-of-life PHP install cannot receive a fix for any vulnerability found after that point.

Sources: PHP Supported Versions, php-src Security Advisories

Data sourced from endoflife.date.