What is end of life (EOL) software? Why PHP2Shell fixes stopped at 8.2 — and 8.2 ends December 31, 2026
End of life (EOL) is when a project stops shipping any fixes, including security patches, for a version. PHP gives each branch two years of active support and two years of security-only support. That is why the October 2026 PHP2Shell fixes shipped only for 8.2 through 8.5, leaving out 8.1, which reached EOL at the end of 2025 — and 8.2 itself ends on December 31, 2026
The three lines
- Definition — the point where a version gets no more fixes, security included
- Lifecycle — usually active support, then security-only, then end of life
- Now — PHP 8.2 ends Dec 31, 2026; Python 3.10 already ended Oct 1
Key questions
- what does end of life mean in software
- **The version's support has ended: no more security patches.** | Stage | Bug fixes | Security patches | |---|---|---| | Active support | Yes | Yes | | Security fixes only | No | Critical only | | End of life | No | No |
- php supported versions 2026
- **As of October 2026: 8.2, 8.3, 8.4 and 8.5.** | Branch | Security support ends | |---|---| | 8.2 | Dec 31, 2026 | | 8.3 | Dec 31, 2027 | | 8.4 | Dec 31, 2028 | | 8.5 | Dec 31, 2029 | | 8.1 | Ended Dec 31, 2025 (last 8.1.34) |
- risks of using end of life software
- **Newly found holes stay open forever.** | Risk | Example | |---|---| | No security patches | PHP2Shell regular fixes skipped 8.1 and older | | Cost of alternatives | Paid distro/LTS support, patching from source | | Knock-on effects | Libraries and frameworks drop support too | | Compliance | Flagged in security audits and certifications |
Same vulnerability, but some versions get a patch and others don't. The dividing line is end of life. When the PHP project fixed the PHP2Shell flaws on October 21, 2026, regular releases shipped only for PHP 8.2, 8.3, 8.4 and 8.5. Version 8.1 and older were already past their lifespan. The PHP team did publish minimal source fixes for 8.1, 8.0 and 7.4, but anyone on those versions has to build from source or rely on a distribution or long-term-support vendor.
End of life (EOL) is the point at which a project stops releasing bug fixes and security patches for a version. The software keeps running after that date — but newly discovered holes are never closed.
1. Support usually ends in three stages
| Stage | Bug fixes | Security patches | Regular releases |
|---|---|---|---|
| Active support | Yes | Yes | Yes |
| Security fixes only | No | Critical only | As needed |
| End of life | No | No | None |
PHP's rule is simple: two years of active support from a branch's first stable release, then two more years of critical security fixes only. After four years, the branch is end of life. Other runtimes use different names and lengths but the same structure: Node.js runs even-numbered majors as long-term support releases, and Python supports each version for about five years.
2. What is still alive in October 2026
PHP
| Branch | Released | Active support ends | Security support ends | Status |
|---|---|---|---|---|
| 8.5 | Nov 20, 2025 | Dec 31, 2027 | Dec 31, 2029 | Active |
| 8.4 | Nov 21, 2024 | Dec 31, 2026 | Dec 31, 2028 | Active |
| 8.3 | Nov 23, 2023 | Dec 31, 2025 | Dec 31, 2027 | Security only |
| 8.2 | Dec 8, 2022 | Dec 31, 2024 | Dec 31, 2026 | Security only — two months left |
| 8.1 | 2021 | — | Dec 31, 2025 | EOL (last 8.1.34) |
| 8.0 | 2020 | — | Nov 26, 2023 | EOL (last 8.0.30) |
| 7.4 | 2019 | — | Nov 28, 2022 | EOL (last 7.4.33) |
Python and Node.js
| Runtime | Version | Security support ends | Status |
|---|---|---|---|
| Python | 3.11 | Oct 31, 2027 | Supported |
| Python | 3.10 | Oct 1, 2026 | EOL |
| Python | 3.9 | Oct 31, 2025 | EOL |
| Node.js | 26 | Apr 30, 2029 | Supported |
| Node.js | 24 | Apr 30, 2028 | Supported (active support ended Oct 20, 2026) |
| Node.js | 22 | Apr 30, 2027 | Supported |
| Node.js | 20 | Apr 30, 2026 | EOL |
If you run PHP 8.2 and just upgraded to 8.2.35 to block PHP2Shell, any flaw found after December 31, 2026 will get no official fix. That is why a move to 8.3 or later belongs on this year's plan. Python 3.10 and Node.js 20 are already past their dates; the Node.js flaw we covered on October 24 was patched only for supported 22, 24 and 26 ("Node2Shell (CVE-2026-111497)").
3. Why people keep running dead versions
| Reason | What it looks like |
|---|---|
| Compatibility | Old frameworks and plugins break on new versions |
| Cost | Code changes and testing take people and time |
| Invisibility | Runtimes embedded in appliances can't be upgraded by users |
| Illusion | EOL software keeps working normally |
The last row is the dangerous one. EOL doesn't stop a program, so it gets forgotten. In the PHP2Shell advisories, Palo Alto said every version of its PAN-OS firewall operating system is affected — PHP was inside the box even if no customer installed it. How to check your server is in today's "PHP2Shell patch versions."
A short checklist
| Step | Action |
|---|---|
| 1 | Inventory runtime versions per server, container and appliance (php -v, python --version, node -v) |
| 2 | Look up each version's security end date on the official page |
| 3 | Plan migrations for anything ending within six months |
| 4 | For EOL versions, check distro or LTS vendor extended support |
| 5 | Ask appliance vendors about their embedded-runtime policy |
4. What this guide doesn't cover
- Extended support: Distributions such as Red Hat and Ubuntu and LTS vendors patch beyond official EOL for varying periods; not summarized here.
- PHP 8.2 timing: The December 31, 2026 end date is from php.net; no extension has been announced as far as we found.