PHP 8.2 Stops Getting Security Fixes on 31 December 2026

On 31 December 2026, PHP 8.2 has its last day of security support, according to php.net. From 1 January 2027 it gets no new security fixes. Your store won't look any different that day: pages load, checkout works, orders come in. That's exactly why it's easy to miss.

It isn't a rare version. On 20 October 2026, W3Techs counted 27.8% of websites on PHP 8 running 8.2. And Magento has two release lines that run on it: 2.4.6 and 2.4.7.

Which PHP each Magento runs on

Adobe's system requirements, updated 13 October 2026, list the PHP versions for each line:

• Magento 2.4.5: PHP 8.1
• Magento 2.4.6: PHP 8.1 and 8.2
• Magento 2.4.7: PHP 8.2 and 8.3
• Magento 2.4.8: PHP 8.3 and 8.4
• Magento 2.4.9: PHP 8.5, with 8.4 allowed only during the upgrade itself

PHP 8.1 lost its security support on 31 December 2025. So a store on 2.4.6 has no supported PHP left from 1 January 2027, whichever of its two it runs.

What end of life means

PHP's rule is short: once the four years of support are completed, the branch reaches its end of life and is no longer supported. Adobe's lifecycle policy adds that Adobe doesn't provide fixes for third-party dependencies such as PHP once they reach end of life, and that you're responsible for the PHP version you run. In its own table, next to 2.4.6 on PHP 8.2, Adobe writes: “PCI compliance at risk from end of 2026”.

One nuance: who built your PHP. Debian 12 ships PHP 8.2, and its long-term support runs until 30 June 2028, but Debian hasn't said how it will patch PHP 8.2 after December. Many Magento servers install PHP from the deb.sury.org packages instead, and their FAQ says packages for releases that reach end of life are removed very shortly. Paid extended support exists too, such as Freexian's PHP LTS. Ask your hosting company which one you have.

Magento 2.4.6 Open Source has a second problem

Adobe's support dates are for Adobe Commerce. The policy says outright that it doesn't apply to Magento Open Source. On 15 October 2026, Sansec wrote that the patches for BlockStrap, a flaw that lets attackers run code on the server, need an Adobe Commerce license on 2.4.4-p18, 2.4.5-p17 and 2.4.6-p15. For a 2.4.6 Open Source store, Adobe has no public patch.

The shortest path from your version

• 2.4.6 on PHP 8.1 or 8.2: upgrade Magento first. 2.4.8 runs on PHP 8.4, which gets security fixes until 31 December 2028.
• 2.4.7 on PHP 8.2: switch to PHP 8.3, which 2.4.7 supports and which gets security fixes until 31 December 2027. Plan 2.4.8 for 2027.
• 2.4.8 on PHP 8.3: you're covered until 31 December 2027. Moving to PHP 8.4 buys you another year.
• 2.4.9: it needs PHP 8.5. Read what the upgrade takes before you jump, because many extensions haven't caught up.

Check your versions in 2 minutes

1. Magento: the admin footer shows the version, for example ver. 2.4.7-p8.
2. PHP: ask your host which version runs the store's PHP-FPM, not just the command line. The two can differ.
3. Where PHP comes from: Debian's own package, deb.sury.org or a paid extended-support build.

The order that avoids surprises

A staging copy, a check of every extension and custom module against the new PHP, the PHP switch on staging, a test of checkout, search and payments, then the switch in production. We walked through the steps for PHP 8.4 in our Magento 2.4.8 post. Make the change after Black Friday on 6 November and before 31 December, so the campaign doesn't run on a fresh change.

Want to know the shortest path for your store? Book a free strategy call. We'll read your Magento and PHP versions together and tell you which step comes first.