Old code doesn't get safer. It gets exploited.
Every PHP version and framework release has a date after which it receives zero security patches. New CVEs keep being found – they just stop being fixed for you. This is the map of what is still protected and what is already a liability.
Paste your composer.json, or a GitHub link to one. Fresh projects on the newest
releases come out around 10. A long-abandoned legacy stack can hit 200.
The runtime under everything. A PHP branch gets 2 years of active support, then 1 more of security-only fixes. Past that, the interpreter running your whole stack is unpatched.
| Version | Released | Security ends | Status today | Known CVEs |
|---|---|---|---|---|
5.6
|
Aug 2014 | Dec 2018 | End of life unpatched 2,851 days | ~95 |
7.0
|
Dec 2015 | Jan 2019 | End of life unpatched 2,841 days | ~50 |
7.1
|
Dec 2016 | Dec 2019 | End of life unpatched 2,516 days | ~45 |
7.2
|
Nov 2017 | Nov 2020 | End of life unpatched 2,151 days | ~40 |
7.3
|
Dec 2018 | Dec 2021 | End of life unpatched 1,780 days | ~35 |
7.4
|
Nov 2019 | Nov 2022 | End of life unpatched 1,423 days | ~35 |
8.0
|
Nov 2020 | Nov 2023 | End of life unpatched 1,060 days | ~28 |
8.1
|
Nov 2021 | Dec 2025 | End of life unpatched 294 days | ~22 |
8.2
|
Dec 2022 | Dec 2026 | Security only 70 days of fixes left | ~14 |
8.3
|
Nov 2023 | Dec 2027 | Security only 435 days of fixes left | ~9 |
8.4
|
Nov 2024 | Dec 2028 | Supported 801 days runway | ~4 |
8.5
|
Nov 2025 | Dec 2029 | Supported 1,166 days runway | ~1 |
LTS lines get ~4 years of security fixes; standard releases get roughly 14 months and then die fast. Most production apps should sit on the newest LTS.
| Version | Released | Security ends | Status today | Known CVEs |
|---|---|---|---|---|
2.8
LTS
|
Nov 2015 | Nov 2019 | End of life unpatched 2,517 days | ~40 |
3.4
LTS
|
Nov 2017 | Nov 2021 | End of life unpatched 1,786 days | ~30 |
4.4
LTS
|
Nov 2019 | Nov 2023 | End of life unpatched 1,065 days | ~22 |
5.4
LTS
|
Nov 2021 | Nov 2028 | Security only 770 days of fixes left | ~15 |
6.4
LTS
|
Nov 2023 | Nov 2027 | Supported 404 days runway | ~8 |
7.0
|
Nov 2023 | Jan 2025 | End of life unpatched 628 days | ~3 |
7.1
|
May 2024 | Jul 2025 | End of life unpatched 447 days | ~3 |
7.2
|
Nov 2024 | Jan 2026 | End of life unpatched 263 days | ~2 |
7.3
|
May 2025 | Jul 2026 | End of life unpatched 82 days | ~1 |
7.4
LTS
|
Nov 2025 | Nov 2029 | Supported 1,135 days runway | ~1 |
8.0
|
Nov 2025 | Jan 2027 | Security only 101 days of fixes left | ~1 |
Since Laravel 6 there is no LTS: every major gets ~18 months of bug fixes and 2 years of security fixes. A yearly major means staying current is the only safe baseline.
| Version | Released | Security ends | Status today | Known CVEs |
|---|---|---|---|---|
6
LTS
|
Sep 2019 | Sep 2022 | End of life unpatched 1,506 days | ~8 |
7
|
Mar 2020 | Mar 2021 | End of life unpatched 2,058 days | ~5 |
8
|
Sep 2020 | Jan 2023 | End of life unpatched 1,366 days | ~7 |
9
|
Feb 2022 | Feb 2024 | End of life unpatched 986 days | ~5 |
10
|
Feb 2023 | Feb 2025 | End of life unpatched 624 days | ~4 |
11
|
Mar 2024 | Mar 2026 | End of life unpatched 223 days | ~3 |
12
|
Feb 2025 | Feb 2027 | Security only 125 days of fixes left | ~1 |
13
|
Mar 2026 | Mar 2028 | Supported 514 days runway | — |
Older majors get bug fixes for ~24 months and security fixes for ~36 months after the next major ships. The 2.x and 3.x lines are long dead; 4.x security support has now lapsed.
| Version | Released | Security ends | Status today | Known CVEs |
|---|---|---|---|---|
2.x
|
Oct 2012 | Jun 2021 | End of life unpatched 1,954 days | ~20 |
3.x
|
May 2015 | Dec 2022 | End of life unpatched 1,406 days | ~12 |
4.x
|
Dec 2019 | Sep 2026 | End of life unpatched 50 days | ~6 |
5.0
|
Sep 2023 | Jan 2026 | End of life unpatched 285 days | ~1 |
5.1
|
Sep 2024 | Jul 2026 | End of life unpatched 112 days | — |
5.2
|
Mar 2025 | Jan 2027 | Security only 79 days of fixes left | — |
5.3
|
Jan 2026 | Jul 2027 | Security only 270 days of fixes left | — |
5.4
|
Jul 2026 | Jan 2028 | Supported 454 days runway | — |
Zend Framework is end-of-life; it was handed to the Laminas Project in 2020. Laminas MVC is now on a wind-down: security fixes only until PHP 8.4's security window closes, then no more releases. Mezzio stays active.
| Version | Released | Security ends | Status today | Known CVEs |
|---|---|---|---|---|
ZF 1
|
Jun 2007 | Sep 2016 | End of life unpatched 3,675 days | ~30 |
ZF 2
|
Sep 2012 | Oct 2018 | End of life unpatched 2,926 days | ~20 |
ZF 3
|
Jun 2016 | Dec 2019 | End of life unpatched 2,486 days | ~8 |
Laminas MVC
|
Jan 2020 | Dec 2028 | Security only 801 days of fixes left | ~3 |
A rewrite split the community: CI3 and CI4 are different frameworks. CI3 was loosely maintained for a couple of years after CI4 shipped in 2020 and is now effectively frozen - huge legacy install base, no real security guarantee.
| Version | Released | Security ends | Status today | Known CVEs |
|---|---|---|---|---|
1.x
|
Feb 2006 | Oct 2011 | End of life unpatched 5,499 days | ~8 |
2.x
|
Jan 2011 | Oct 2015 | End of life unpatched 4,038 days | ~10 |
3.x
|
Apr 2015 | Oct 2022 | End of life unpatched 1,481 days | ~12 |
4.x
|
Feb 2020 | — | Supported | ~4 |
Yii 1.1 has been "ending" since 2015 and keeps getting short extensions - security and PHP-compat fixes only, now down to its final months. Yii 2.0 is in security-only wind-down; Yii 3 only reached stable at the end of 2025.
| Version | Released | Security ends | Status today | Known CVEs |
|---|---|---|---|---|
1.1
|
Jan 2010 | Dec 2026 | Security only 70 days of fixes left | ~15 |
2.0
|
Oct 2014 | Nov 2027 | Security only 397 days of fixes left | ~10 |
3.0
|
Dec 2025 | — | Supported | — |
The ORM under most PHP apps. SQL-injection advisories have hit it over the years, so the version matters. ORM 3.x shipped in 2024; the long-lived 2.x line is winding down. Doctrine publishes no firm EOL, so these dates are estimates.
| Version | Released | Security ends | Status today | Known CVEs |
|---|---|---|---|---|
2.x
|
Jan 2011 | Dec 2026 | Security only 70 days of fixes left | ~6 |
3.x
|
Jan 2024 | — | Supported | ~1 |
A CMS rather than a plain framework, but a huge PHP target with a brutal upgrade history (Drupalgeddon). Each major is a hard cutoff: Drupal 7, 8 and 9 are all end-of-life, and Drupal 10 security support closes at the end of 2026.
| Version | Released | Security ends | Status today | Known CVEs |
|---|---|---|---|---|
7
|
Jan 2011 | Jan 2025 | End of life unpatched 654 days | ~30 |
8
|
Nov 2015 | Nov 2021 | End of life unpatched 1,814 days | ~15 |
9
|
Jun 2020 | Nov 2023 | End of life unpatched 1,085 days | ~8 |
10
|
Dec 2022 | Dec 2026 | Security only 48 days of fixes left | ~5 |
11
|
Aug 2024 | Jul 2027 | Supported 258 days runway | ~2 |
An end-of-life version is not "old but fine". When a vulnerability is disclosed, supported branches get a patch the same day – your EOL branch gets a public exploit and nothing else. You are now the easiest target on the list.
Upgrading is cheaper than a breach, and far cheaper the sooner you do it. The gap between your version and the supported one only widens: each skipped release adds deprecations, behavior changes and a bigger jump later. Move to a line with a green runway above, and keep it there.
Approximate data. CVE counts are rounded aggregates per branch, not authoritative tallies; lifecycle dates follow published vendor policies and may be extended. Status and day counts are computed at render time against the server clock.
