Latest PHP Version: 8.5 Now, 8.6 Next, and What WordPress Needs

PHP versions and end-of-life dates

Every PHP version gets four years of life. For the first two years it gets bug fixes and security fixes, which PHP calls active support. For the next two it gets security fixes only. After that it's end of life: no fixes at all, even for a flaw that attackers are already using.

The dates come from the PHP project's supported versions page. PHP 7.4, 8.0 and everything older ended years ago.

Key finding

Run PHP 8.3 or newer. PHP 8.2 still gets security fixes, but only until December 31, 2026, so treat it as the absolute minimum and move off it this quarter.

Why end of life matters more than features

The October 21 release shows why. The PHP project fixed two critical flaws that can let an attacker with no account run code on a server, and attacks started the same day. Versions 8.2 through 8.5 got patched releases that day. PHP 8.1 and older got none, because the project no longer ships releases for them. It only published minimal source patches, which help people who compile PHP themselves and nobody else. We covered that release and what to do about it in our PHP2Shell guide.

That's the real cost of an old PHP version. A WordPress site can be fully updated and still run on a server with a known hole that will never be fixed. No security plugin can patch PHP, because PHP has already handled the request before any plugin loads.

Which PHP versions WordPress supports

WordPress 7.1.3 is the current release. Its requirements page lists PHP 8.3 or newer as recommended. The technical minimum is still PHP 7.4, kept for old servers that can't move yet. WordPress 7.0 dropped support for PHP 7.2 and 7.3.

The core team's compatibility table marks WordPress 6.9, 7.0 and 7.1 as supported on PHP 8.1 through 8.5. WordPress 6.7 and 6.8 stop at 8.4. That covers WordPress core only. Your plugins and theme have their own limits, and they're usually what breaks.

Here's how WordPress sites actually split, from WordPress.org's PHP version statistics:

PHP 7.4 alone still runs 16.1% of WordPress sites, almost six years after its release. PHP 8.3 is the most common version at 26.6%, and only 3.9% have moved to 8.5.

What Site Health tells you, and what it doesn't

WordPress has its own PHP check under Tools > Site Health. It asks a WordPress.org service whether your PHP version is supported and secure, then shows one of four messages:

There's a gap here worth knowing about. We asked that WordPress.org service directly, and today it still reports PHP 8.1 as secure, even though the PHP project ended 8.1's security support in December 2025. So a site on 8.1 sees a gentle "should be updated" notice, not the critical warning. Don't take the softer wording as a pass. PHP 8.1 got no fix for the October 21 flaws.

What's new in PHP 8.5

PHP 8.5 came out on November 20, 2025. For site owners, the change you'll notice is that plugins written for it can do more. Here's what developers got, from the PHP 8.5 release page:

• A pipe operator (|>), which passes a value through a chain of functions without nesting them.
• A built-in URI extension that parses web addresses to the RFC 3986 and WHATWG standards. URL parsing differences are a classic source of security bugs, so this one matters.
• Clone with, written clone($object, [...]), for copying an object while changing some of its properties.
• #[\NoDiscard], which warns when code ignores a return value it shouldn't ignore.
• array_first() and array_last(), small helpers that every codebase has written by hand for years.
• Backtraces on fatal errors, so a crash log shows where the error came from.

What PHP 8.5 and 8.4 break

New PHP versions also deprecate old habits. A deprecation isn't an error. The code still runs, but PHP logs a notice, and the feature will be removed in a later version. Notices pile up in your error log and show on screen if WP_DEBUG_DISPLAY is on.

PHP 8.5 deprecates the backtick operator for running shell commands, the old cast spellings (boolean), (integer), (double) and (binary), and using null as an array key. PHP 8.4 deprecated implicitly nullable parameters, the function f(Type $x = null) pattern that's all over older plugins. It also moved the IMAP extension out of core, which breaks plugins that read email inboxes unless your host installs IMAP separately.

PHP 8.6: what's coming on November 19

The next version is PHP 8.6, not PHP 9. The PHP project's release schedule plans general availability for November 19, 2026, after a fifth release candidate on November 5. The dates can still move.

Features already accepted and merged for 8.6 include a clamp() function, partial function application, a Duration class, more secure default settings for sessions, and function arguments shown in error messages. The full list is in the PHP RFC index.

Should you switch to 8.6 when it lands? Not on a live site, not in November. Wait until your host offers it, your key plugins say they support it, and a few patch releases have gone out. A version that just arrived has had the least real-world testing. PHP 8.4 or 8.5 gets you every security fix without being the first to find the bugs.

Which PHP version should your WordPress site run?

The minor version isn't the whole story either. PHP 8.3.30 and 8.3.36 are both "PHP 8.3", but only 8.3.36 has the October 21 security fixes. Make sure your host keeps the patch number current, not just the branch.

How you actually change it depends on your host. Our step-by-step guide to checking and updating your WordPress PHP version covers cPanel, Plesk, managed WordPress hosts and your own server. Test the switch on a staging copy first if you can, and keep a backup either way. Our WordPress security checklist has the rest of the basics.

Check your site

Run a free scan at wpvanguard.com. If your server announces its PHP version, the scan reports it and tells you whether that version has the latest security fixes. It also checks your plugins against our vulnerability database. The weekly patch list covers the plugin side.

References

• PHP supported versions and unsupported branches
• PHP 8.5 release announcement
• PHP 8.6 release schedule
• PHP RFC index
• PHP security release, October 21, 2026 and GHSA-6wmf-4rv5-p3rp
• WordPress requirements
• PHP compatibility and WordPress versions
• Dropping support for PHP 7.2 and 7.3
• WordPress.org PHP version statistics