PHP 8.2 end of life: why Statamic sites should move to 8.4

PHP 8.2 security support ends on December 31, 2026. Active support already ended on December 31, 2024. If a Statamic or Laravel site is still on 8.2, it is in the “security fixes only” window right now, and that window closes on the same day Statamic 5’s security fixes are scheduled to end.

php.net defines the windows in one place, and the wording is worth using as-is. Each branch gets two years of active support. During that time, reported bugs and security issues are fixed in regular point releases. Then it gets two more years of critical security fixes only. Those releases happen when they are needed. There may be several point releases, or none. After four years the branch is end of life and is no longer supported. php.net tells users of an end-of-life release to upgrade as soon as possible, because they may be exposed to unpatched vulnerabilities.

“Security fixes only” does not mean a steady drip of patches. It means a critical security issue might get a release, and an ordinary bug will not. Once December 31, 2026 has passed, PHP 8.2 gets neither.

Where 8.3, 8.4, and 8.5 actually sit

These dates are from PHP’s supported-versions table, checked November 4, 2026:

PHP 8.2: active support ended December 31, 2024. Security support ends December 31, 2026.
PHP 8.3: active support ended December 31, 2025. Security support ends December 31, 2027.
PHP 8.4: active support ends December 31, 2026. Security support ends December 31, 2028.
PHP 8.5: released November 20, 2025. Active support ends December 31, 2027. Security support ends December 31, 2029.

Read the 8.4 line carefully. On the day PHP 8.2 dies, PHP 8.4 itself leaves active support and enters security-only, with security fixes running through December 31, 2028. PHP 8.5 is still in active support until December 31, 2027, and security support until December 31, 2029. “Jump to 8.4” in the title of this article means “leave 8.2 for 8.4 or 8.5.” It does not mean “stop short of 8.5.”

Why Statamic’s minimum is the wrong place to stop

Statamic 6 requires PHP 8.3 or newer and Laravel 12 or newer. The support policy lists Statamic 6 as PHP 8.3 through 8.5. So PHP 8.3 is a legal runtime for Statamic 6. It is a poor place to stop.

PHP 8.3’s security support ends on December 31, 2027. Statamic 7 is listed for Q1 2027 as PHP 8.4 through 8.6 and Laravel 13 through 14. The bug-fix and security dates for Statamic 7 are still “to be confirmed,” and Statamic says the whole schedule can change. The listing is still the best public signal of the next floor: a site that moves to 8.3 for Statamic 6 is lined up for another PHP upgrade when Statamic 7 lands.

PHP 8.4 and PHP 8.5 are both inside Statamic 6’s published range (8.3 through 8.5) and both meet the PHP 8.4 floor listed for Statamic 7. PHP 8.4’s security support runs through December 2028. PHP 8.5’s runs through December 2029. One move now, instead of a second project a year later. The 5 to 6 guide’s own recommendation is stronger than “8.4 is enough”: Statamic says to go all the way to Laravel 13 and PHP 8.5.

Statamic 5, the version you are leaving, is listed as PHP 8.2 through 8.4. Keep a Statamic 5 site on 8.4 or below. PHP 8.5 belongs with Statamic 6.

The same calendar day matters for Statamic itself. Statamic 5 security fixes run through December 2026, and bug fixes already ended in March 2026. A site that is on Statamic 5 and PHP 8.2 is watching two supported-version clocks hit zero together.

What your Laravel version will actually allow

You cannot pick a PHP version in isolation. Laravel’s support table is the constraint:

Laravel 10 supports PHP 8.1 through 8.3. Security support ended February 4, 2025. PHP 8.4 is outside that range. Do not point a Laravel 10 app at PHP 8.4 and expect it to be a supported combination.
Laravel 11 supports PHP 8.2 through 8.4. Security support ended March 12, 2026. This is the first Laravel version on this path where PHP 8.4 is inside the published range.
Laravel 12 supports PHP 8.2 through 8.5. Security support ends February 24, 2027. Bug fixes ended August 13, 2026.
Laravel 13 supports PHP 8.3 through 8.5. It requires PHP 8.3 at a minimum. Security support runs until March 17, 2028.

So the PHP move and the Laravel move are interleaved. On Laravel 10, stay on PHP 8.2 or 8.3. After Laravel 11 is installed and booting, 8.4 is a supported runtime. Stay off 8.5 until Statamic 6 is in, because Statamic 5’s table stops at 8.4. Laravel 12 will run 8.5, and Statamic 6 lists it. The step-by-step order is in Upgrading Statamic 5 on Laravel 10 or 11 to Statamic 6.

What the move actually is

For most application code, this is a runtime change: local, CI, staging, and production all have to run the same PHP, including the extensions you already use. intl, gd or imagick (Glide), exif, and bcmath are the ones that usually matter on a Statamic site. Set config.platform.php to the production version so Composer’s lockfile matches the server you will deploy to, not whatever happened to be on a laptop.

The PHP 8.4 language change that shows up most often in application code and older addons is implicitly nullable parameters. A signature written as function foo(Bar $bar = null) is deprecated. The fix is function foo(?Bar $bar = null). The rest of the deprecation list is on PHP’s 8.4 migration page. Run the test suite with deprecations visible after the runtime is on 8.4, and fix what your own code reports. You do not need a line-by-line rewrite to leave 8.2.

Laravel Shift will open the Laravel version pull requests if you want that part automated. It does not choose your PHP version, and it does not upgrade Statamic. The runtime is still yours to install on the machines that boot the site.

Sources

What to do next

Start with the free Statamic 6 readiness checklist. It is the order of operations, with nothing to download and no email gate.

The Upgrade Kit for Statamic 6 is the paid runbook and scripts for the same path, including the Laravel hops, PHP, addons, and a static build.

If you want the work done for you, start with a Rescue Audit.

Segment Holdings is not affiliated with or endorsed by Statamic. This is a product for Statamic, not a Statamic product.