PHP ↗

PHP · Web / Runtime

Track your version:Monitors PHP and tailors your dashboard to that exact version.

8.5.12 · latest cycle100/100 Healthy

What to do about PHP

PHP “php2shell” RCE (CVE-2026-109618/109619): what to do now — Two critical, unauthenticated remote-code-execution flaws in PHP core (CVSS 9.2), with exploitation reported. Read the runbook →

Summary iPlain-English security verdict for PHP, generated from its current health score, actively-exploited vulnerabilities, and latest supported version.

PHP currently scores 100/100 — healthy. 5 actively-exploited vulnerabilities (CISA KEV) affect older releases (e.g. CVE-2012-1823) — staying on the latest supported version keeps you clear of them. The latest supported release is 8.5.12. It's on the latest patch with no significant known issues — keep it current.

Disclosure trend iNew CVEs published for PHP each year (NVD). A higher bar means more disclosures that year — more scrutiny, not necessarily less safe.

'19

'20

'21

'22

'23

'24

'25

'26

2 of its known vulnerabilities are linked to ransomware campaigns (CISA KEV).

Patch priority — what to act on iThe issues to fix first — actively exploited (CISA KEV) first, then by exploitation probability (EPSS), then severity. Each row's "→ fixed in" is the earliest version that patches it; "see advisory" means no fixed version is published.

Most urgent first — actively exploited, then likeliest to be exploited.

CVE-2012-1823 CRITICAL exploited Command injection EPSS 100% → fixed in 5.4.2 CVE-2026-109619 HIGH exploited Use-after-free EPSS 100% → fixed in 8.5.12 CVE-2024-4577 CRITICAL exploited ransomware OS command injection EPSS 100% → fixed in 8.3.8 CVE-2026-109618 CRITICAL exploited Use-after-free EPSS 100% → fixed in 8.5.12 CVE-2019-11043 HIGH exploited ransomware Buffer overflow EPSS 100% → fixed in 7.3.11 CVE-2018-19518 HIGH CWE-88 EPSS 96% → see advisory CVE-2015-0235 HIGH Out-of-bounds write EPSS 95% → fixed in 5.6.6 CVE-2018-7584 CRITICAL Memory corruption EPSS 87% → fixed in 7.0.28 CVE-2011-4885 MEDIUM Improper input validation EPSS 83% → see advisory CVE-2018-5712 MEDIUM Cross-site scripting (XSS) EPSS 80% → see advisory CVE-2019-6977 HIGH Out-of-bounds write EPSS 71% → fixed in 7.2.14 CVE-2012-2311 HIGH SQL injection EPSS 69% → see advisory

See all 758 known PHP CVEs & security history →

How to patch PHP — step-by-step to the latest secure version →

Get alerted about PHP

Be emailed the moment PHP gets a newly exploited vulnerability (CISA KEV) or a release reaches end of life. Free · double opt-in · unsubscribe anytime.

We email only on real events for PHP — no marketing, no sharing, and we never know what you run. Track your whole stack →

Versions & lifecycle iWhen each release line stops receiving security patches (end-of-life). After EOL there are no more fixes — plan upgrades before these dates.

How long each PHP release line is supported — and when it sunsets. Select a line for its full report.

Dec31'29 PHP 8.5EOL 2029-12-31

Dec31'28 PHP 8.4EOL 2028-12-31

Dec31'27 PHP 8.3EOL 2027-12-31

Dec31'26 PHP 8.2EOL 2026-12-31

Dec31'25 PHP 8.1ended 2025-12-31

Nov26'23 PHP 8.0ended 2023-11-26

Nov28'22 PHP 7.4ended 2022-11-28

Dec6'21 PHP 7.3ended 2021-12-06

Nov30'20 PHP 7.2ended 2020-11-30

Dec1'19 PHP 7.1ended 2019-12-01

Jan10'19 PHP 7.0ended 2019-01-10

Dec31'18 PHP 5.6ended 2018-12-31

Full PHP end-of-life dates & support timeline →

8.5 latest 8.5.12 Supported until 2029-12-318.5.12 → 8.4 latest 8.4.27 Supported until 2028-12-318.4.27 → 8.3 latest 8.3.36 Supported until 2027-12-318.3.36 → 8.2 latest 8.2.35 Supported until 2026-12-318.2.35 → 8.1 latest 8.1.34 End of life ended 2025-12-318.1.34 → 8.0 latest 8.0.30 End of life ended 2023-11-268.0.30 → 7.4 latest 7.4.33 End of life ended 2022-11-287.4.33 → 7.3 latest 7.3.33 End of life ended 2021-12-067.3.33 → 7.2 latest 7.2.34 End of life ended 2020-11-307.2.34 → 7.1 latest 7.1.33 End of life ended 2019-12-017.1.33 → See all upcoming end-of-life dates →

Frequently asked

Is PHP safe and patched?

What should I do about PHP now?

Upgrade PHP to the latest supported release (8.5.12) or later, which clears the actively-exploited issues affecting older versions, then confirm against PHP's official advisory.

When does PHP reach end-of-life?

The latest supported PHP release is 8.5.12. After end-of-life a release no longer receives security patches.

Which versions of PHP are still receiving security updates?

Supported PHP release lines (latest 8.5.12): 8.5, 8.4, 8.3, 8.2. End-of-life releases no longer receive security patches.

Informational only, from public data (NVD · CISA KEV · EPSS · endoflife.date), and can lag or miss vendor-specific fixes. Always confirm against PHP's official advisory before you patch or upgrade — PHP official site ↗