Statamic 5 end of life: what happens on December 31, 2026

Statamic 5 does not shut off on December 31, 2026. The site you already have keeps serving pages. If the published schedule holds, what ends that month is security fixes for Statamic 5.

Statamic’s support policy gives each major about a year of bug fixes and 18 months of security fixes. The table for Statamic 5 lists bug fixes until March 2026 and security fixes until December 2026. Bug-fix support is already over. Through December, Statamic 5 is in the window people call “security fixes only”: security issues can still be patched, and ordinary bug fixes are not part of the commitment. The policy says the dates can change, because they depend on Laravel and on other packages.

PHP’s supported-versions page is the plain-language definition of that middle window, and the shape is the same. After active support, a branch receives critical security fixes only. Releases in that period are made when they are needed. There may be several, or there may be none. When the security window ends, the branch is end of life. php.net tells people on an end-of-life release to upgrade as soon as possible, because they may be exposed to unpatched vulnerabilities. Statamic does not use those exact labels. The practical meaning of December 31, 2026 is the same one: after that date, a new vulnerability in Statamic 5 is yours to carry.

What does not happen on that date

Nothing in the support policy uninstalls Statamic, expires a license, or closes the control panel. A site that worked on December 30 still works on January 1. The change is that a newly reported Statamic 5 issue should not be expected to get a patch.

The other layers under a typical Statamic 5 site do not share one clock:

• PHP 8.2 security support ends the same day, December 31, 2026. Active support already ended on December 31, 2024. The details, and why the useful target is PHP 8.4 or 8.5 rather than the Statamic 6 minimum, are in PHP 8.2 end of life for Laravel and Statamic sites.
• Laravel 10 security support ended on February 4, 2025. Laravel 11 security support ended on March 12, 2026. A Statamic 5 site on either of those is already running a framework Laravel no longer patches.
• Laravel 12 security support ends on February 24, 2027. Bug fixes for Laravel 12 ended on August 13, 2026, so Laravel 12 is already in its own security-only stretch. It is not the piece that is already overdue.

Statamic 5’s published matrix still lists Laravel 10 through 12 and PHP 8.2 through 8.4. Alongside that, a merged change on the 5.x line (statamic/cms #14793) drops Laravel 10 and 11 from new 5.x releases. The reason given there is that Composer 2.10’s advisory checks refuse to install those Laravel versions. The same note says the commitment to security fixes through December is for Statamic itself. It is not a promise that new 5.x releases will keep installing on Laravel 10 or 11. If composer update on a Laravel 10 or 11 app can no longer resolve the newest Statamic 5, you are already stuck for Statamic security releases, before December 31 arrives.

What staying costs

The risk is the next report, not a countdown outage on New Year’s Eve. A security fix that lands in Statamic 6 will not be back-applied to a major that is out of security support. The same is true of PHP 8.2 after December 31, and it is already true of Laravel 10 and Laravel 11. Hosts, client security reviews, and insurance questionnaires ask whether the stack is supported. “It still runs” is accurate. It is a thin answer to “who patches it.”

Statamic 6.0.0 was published on January 28, 2026, so the 5 to 6 guide has been public for months. The launch post is the feature overview. The Statamic and PHP deadlines landing on one day are a reason to pick a path now.

Statamic 6, the line you would be moving to, lists bug fixes until March 2027 and security fixes until December 2027. It requires PHP 8.3 or newer and Laravel 12 or newer. It supports PHP 8.3 through 8.5, and Laravel 12 and 13. The upgrade guide recommends going on to Laravel 13 and PHP 8.5. Statamic 7 is listed for Q1 2027, with PHP 8.4 through 8.6 and Laravel 13 through 14. The Statamic 7 bug-fix and security dates are still marked to be confirmed, and the policy says the schedule can change.

Which path you are on

Read the official 5 to 6 upgrade guide before you change a constraint. The first line is the decision.

Already on Laravel 12, with no custom code. The guide says that for most sites already running Laravel 12 or newer, the process takes less than five minutes. In practice that is a statamic/cms constraint of ^6.0, then composer update statamic/cms --with-dependencies, then a pass through the guide for any item that names your site. No custom fieldtypes. No Vue components in the app or in addons you maintain. No static-build pipeline you have to move by hand. If that is the site, follow the official guide. We would rather you did that than treat a short composer bump as a project. One gap still counts: Statamic 6 requires PHP 8.3 or newer. A Laravel 12 site that is still on PHP 8.2 has a PHP move in front of the five minutes.

Every other site. Plan the path. Laravel 10 or 11, PHP 8.2, custom fieldtypes or addons, Vue 2 in the control panel, multisite, a timezone other than UTC, or a static deploy. Those are separate upgrades. The five-minute sentence assumes the Laravel 12 part is already done. Do the rest in an order the support tables allow, one hop at a time. That order is written up in Upgrading Statamic 5 on Laravel 10 or 11 to Statamic 6.

Statamic 6’s minimum PHP version is 8.3, not 8.4. Stopping at 8.3 gets the site onto Statamic 6 and leaves another PHP upgrade in front of Statamic 7, which is listed from PHP 8.4. PHP 8.4’s security support runs through December 31, 2028. PHP 8.5’s runs through December 31, 2029. Moving to 8.4 or 8.5 now is one PHP upgrade instead of two. Statamic’s own recommendation on the 5 to 6 guide is Laravel 13 and PHP 8.5.

Sources

• PHP supported versions
• Statamic release and support policy
• Statamic 5 to 6 upgrade guide
• Statamic 6.0.0 release (published January 28, 2026)
• Statamic 6 launch post
• Laravel release notes and support table
• statamic/cms #14793

What to do next

Start with the free Statamic 6 readiness checklist. It is the order of operations, with nothing to download and no email gate.

The Upgrade Kit for Statamic 6 is the paid runbook and scripts for the same path, including the Laravel hops, PHP, addons, and a static build.

If you want the work done for you, start with a Rescue Audit.