Old code doesn't get safer. It gets exploited.
Every PHP version and framework release has a date after which it receives zero security patches. New CVEs keep being found – they just stop being fixed for you. This is the map of what is still protected and what is already a liability.
The runtime under everything. A PHP branch gets 2 years of active support, then 1 more of security-only fixes. Past that, the interpreter running your whole stack is unpatched.
| Version | Released | Security ends | Status today | Known CVEs |
|---|---|---|---|---|
5.3
|
Jun 2009 | Aug 2014 | End of life unpatched 4,471 days | ~120 CVSS 9+ 9+: 8 · 8: 15 |
5.4
|
Mar 2012 | Sep 2015 | End of life unpatched 4,086 days | ~110 CVSS 9+ 9+: 7 · 8: 14 |
5.5
|
Jun 2013 | Jul 2016 | End of life unpatched 3,764 days | ~100 CVSS 9+ 9+: 6 · 8: 13 |
5.6
|
Aug 2014 | Dec 2018 | End of life unpatched 2,871 days | ~95 CVSS 9+ 9+: 6 · 8: 12 |
7.0
|
Dec 2015 | Jan 2019 | End of life unpatched 2,861 days | ~161 CVSS 9+ 9+: 77 · 8: 13 |
7.1
|
Dec 2016 | Dec 2019 | End of life unpatched 2,536 days | ~80 CVSS 9+ 9+: 31 · 8: 4 |
7.2
|
Nov 2017 | Nov 2020 | End of life unpatched 2,171 days | ~68 CVSS 9+ 9+: 17 · 8: 3 |
7.3
|
Dec 2018 | Dec 2021 | End of life unpatched 1,800 days | ~62 CVSS 9+ 9+: 16 · 8: 3 |
7.4
|
Nov 2019 | Nov 2022 | End of life unpatched 1,443 days | ~43 CVSS 9+ 9+: 6 · 8: 2 |
8.0
|
Nov 2020 | Nov 2023 | End of life unpatched 1,080 days | ~31 CVSS 9+ 9+: 8 · 8: 3 |
8.1
|
Nov 2021 | Dec 2025 | End of life unpatched 314 days | ~47 CVSS 9+ 9+: 10 · 8: 5 |
8.2
|
Dec 2022 | Dec 2026 | Security only 50 days of fixes left | ~49 CVSS 9+ 9+: 10 · 8: 4 |
8.3
|
Nov 2023 | Dec 2027 | Security only 415 days of fixes left | ~44 CVSS 9+ 9+: 9 · 8: 3 |
8.4
|
Nov 2024 | Dec 2028 | Supported 781 days runway | ~30 CVSS 9+ 9+: 4 · 8: 3 |
8.5
|
Nov 2025 | Dec 2029 | Supported 1,146 days runway | ~21 CVSS 9+ 9+: 3 · 8: 3 |
LTS lines get ~4 years of security fixes; standard releases get roughly 14 months and then die fast. Most production apps should sit on the newest LTS.
| Version | Released | Security ends | Status today | Known CVEs |
|---|---|---|---|---|
2.8
LTS
|
Nov 2015 | Nov 2019 | End of life unpatched 2,537 days | ~44 CVSS 9+ 9+: 5 · 8: 4 |
3.4
LTS
|
Nov 2017 | Nov 2021 | End of life unpatched 1,806 days | ~38 CVSS 9+ 9+: 4 · 8: 4 |
4.4
LTS
|
Nov 2019 | Nov 2023 | End of life unpatched 1,085 days | ~27 CVSS 8+ 8: 2 |
5.4
LTS
|
Nov 2021 | Nov 2028 | Security only 750 days of fixes left | ~25 CVSS 8+ 8: 1 |
6.4
LTS
|
Nov 2023 | Nov 2027 | Supported 384 days runway | ~31 CVSS 8+ 8: 1 |
7.0
|
Nov 2023 | Jan 2025 | End of life unpatched 648 days | ~27 CVSS 8+ 8: 1 |
7.1
|
May 2024 | Jul 2025 | End of life unpatched 467 days | ~29 CVSS 8+ 8: 1 |
7.2
|
Nov 2024 | Jan 2026 | End of life unpatched 283 days | ~27 CVSS 7+ |
7.3
|
May 2025 | Jul 2026 | End of life unpatched 102 days | ~29 CVSS 7+ |
7.4
LTS
|
Nov 2025 | Nov 2029 | Supported 1,115 days runway | ~30 CVSS 6+ |
8.0
|
Nov 2025 | Jan 2027 | Security only 81 days of fixes left | ~30 CVSS 6+ |
Since Laravel 6 there is no LTS: every major gets ~18 months of bug fixes and 2 years of security fixes. A yearly major means staying current is the only safe baseline.
| Version | Released | Security ends | Status today | Known CVEs |
|---|---|---|---|---|
6
LTS
|
Sep 2019 | Sep 2022 | End of life unpatched 1,526 days | ~15 CVSS 9+ 9+: 2 · 8: 1 |
7
|
Mar 2020 | Mar 2021 | End of life unpatched 2,078 days | ~14 CVSS 9+ 9+: 1 · 8: 1 |
8
|
Sep 2020 | Jan 2023 | End of life unpatched 1,386 days | ~11 CVSS 8+ 8: 1 |
9
|
Feb 2022 | Feb 2024 | End of life unpatched 1,006 days | ~5 CVSS 8+ 8: 1 |
10
|
Feb 2023 | Feb 2025 | End of life unpatched 644 days | ~5 CVSS 8+ 8: 1 |
11
|
Mar 2024 | Mar 2026 | End of life unpatched 243 days | ~7 CVSS 8+ 8: 1 |
12
|
Feb 2025 | Feb 2027 | Security only 105 days of fixes left | ~4 CVSS 8+ 8: 1 |
13
|
Mar 2026 | Mar 2028 | Supported 494 days runway | ~3 CVSS 8+ 8: 1 |
Older majors get bug fixes for ~24 months and security fixes for ~36 months after the next major ships. The 2.x and 3.x lines are long dead; 4.x security support has now lapsed.
| Version | Released | Security ends | Status today | Known CVEs |
|---|---|---|---|---|
2.x
|
Oct 2012 | Jun 2021 | End of life unpatched 1,974 days | ~9 CVSS 8+ 8: 1 |
3.x
|
May 2015 | Dec 2022 | End of life unpatched 1,426 days | ~10 CVSS 8+ 8: 1 |
4.x
|
Dec 2019 | Sep 2026 | End of life unpatched 70 days | ~6 CVSS 9+ 9+: 1 · 8: 1 |
5.0
|
Sep 2023 | Jan 2026 | End of life unpatched 305 days | ~3 |
5.1
|
Sep 2024 | Jul 2026 | End of life unpatched 132 days | ~4 |
5.2
|
Mar 2025 | Jan 2027 | Security only 59 days of fixes left | ~5 CVSS 5+ |
5.3
|
Jan 2026 | Jul 2027 | Security only 250 days of fixes left | ~5 CVSS 5+ |
5.4
|
Jul 2026 | Jan 2028 | Supported 434 days runway | — |
Zend Framework is end-of-life; it was handed to the Laminas Project in 2020. Laminas MVC is now on a wind-down: security fixes only until PHP 8.4's security window closes, then no more releases. Mezzio stays active.
| Version | Released | Security ends | Status today | Known CVEs |
|---|---|---|---|---|
ZF 1
|
Jun 2007 | Sep 2016 | End of life unpatched 3,695 days | ~30 CVSS 9+ 9+: 2 · 8: 5 |
ZF 2
|
Sep 2012 | Oct 2018 | End of life unpatched 2,946 days | ~20 CVSS 9+ 9+: 1 · 8: 3 |
ZF 3
|
Jun 2016 | Dec 2019 | End of life unpatched 2,506 days | ~8 CVSS 8+ 8: 2 |
Laminas MVC
|
Jan 2020 | Dec 2028 | Security only 781 days of fixes left | ~3 CVSS 6+ |
A rewrite split the community: CI3 and CI4 are different frameworks. CI3 was loosely maintained for a couple of years after CI4 shipped in 2020 and is now effectively frozen - huge legacy install base, no real security guarantee.
| Version | Released | Security ends | Status today | Known CVEs |
|---|---|---|---|---|
1.x
|
Feb 2006 | Oct 2011 | End of life unpatched 5,519 days | ~8 CVSS 9+ 9+: 1 · 8: 2 |
2.x
|
Jan 2011 | Oct 2015 | End of life unpatched 4,058 days | ~10 CVSS 9+ 9+: 1 · 8: 2 |
3.x
|
Apr 2015 | Oct 2022 | End of life unpatched 1,501 days | ~5 CVSS 10+ 9+: 3 |
4.x
|
Feb 2020 | — | Supported | ~18 CVSS 9+ 9+: 6 · 8: 2 |
Yii 1.1 has been "ending" since 2015 and keeps getting short extensions - security and PHP-compat fixes only, now down to its final months. Yii 2.0 is in security-only wind-down; Yii 3 only reached stable at the end of 2025.
| Version | Released | Security ends | Status today | Known CVEs |
|---|---|---|---|---|
1.1
|
Jan 2010 | Dec 2026 | Security only 50 days of fixes left | ~4 CVSS 8+ 8: 2 |
2.0
|
Oct 2014 | Nov 2027 | Security only 377 days of fixes left | ~12 CVSS 9+ 9+: 2 · 8: 3 |
3.0
|
Dec 2025 | — | Supported | — |
The ORM under most PHP apps. SQL-injection advisories have hit it over the years, so the version matters. ORM 3.x shipped in 2024; the long-lived 2.x line is winding down. Doctrine publishes no firm EOL, so these dates are estimates.
| Version | Released | Security ends | Status today | Known CVEs |
|---|---|---|---|---|
2.x
|
Jan 2011 | Dec 2026 | Security only 50 days of fixes left | ~2 CVSS 7+ |
3.x
|
Jan 2024 | — | Supported | ~1 CVSS 6+ |
A CMS rather than a plain framework, but a huge PHP target with a brutal upgrade history (Drupalgeddon). Each major is a hard cutoff: Drupal 7, 8 and 9 are all end-of-life, and Drupal 10 security support closes at the end of 2026.
| Version | Released | Security ends | Status today | Known CVEs |
|---|---|---|---|---|
7
|
Jan 2011 | Jan 2025 | End of life unpatched 674 days | ~30 CVSS 9+ 9+: 3 · 8: 6 |
8
|
Nov 2015 | Nov 2021 | End of life unpatched 1,834 days | ~174 CVSS 9+ 9+: 13 · 8: 10 |
9
|
Jun 2020 | Nov 2023 | End of life unpatched 1,105 days | ~114 CVSS 9+ 9+: 6 · 8: 3 |
10
|
Dec 2022 | Dec 2026 | Security only 28 days of fixes left | ~57 CVSS 9+ 9+: 4 |
11
|
Aug 2024 | Jul 2027 | Supported 238 days runway | ~45 CVSS 9+ 9+: 3 |
An end-of-life version is not "old but fine". When a vulnerability is disclosed, supported branches get a patch the same day – your EOL branch gets a public exploit and nothing else. You are now the easiest target on the list.
Upgrading is cheaper than a breach, and far cheaper the sooner you do it. The gap between your version and the supported one only widens: each skipped release adds deprecations, behavior changes and a bigger jump later. Move to a line with a green runway above, and keep it there.
CVE data is pulled from public feeds - framework advisories from osv.dev, PHP runtime CVEs from the NVD - and refreshed on a schedule; the CVSS badge marks the severity band of the worst known CVE on that branch. Branches missing from the feed fall back to curated figures. Lifecycle dates follow published vendor policies and may be extended. Status and day counts are computed at render time against the server clock.
