End of life / PHP / 8.0
PHP 8.0 end of life
PHP 8.0 reached end of life on 26 November 2023, 1,062 days ago. 6 known CVEs reach this release, the most severe rated CRITICAL.
The detail
- Released
- 26 November 2020
- End of life
- 26 November 2023
- Countdown
- 1,062 days ago
- Status
- End of life
- Long term support
- No
- Newest build on this release
- 8.0.30
- Newest release overall
- 8.5.12
CVEs that reach 8.0
| Advisory | Severity | CVSS | Published | Fixed in |
|---|---|---|---|---|
| CVE-2023-3824 Buffer overflow and overread in phar_dir_read() | CRITICAL | 9.4 | 5 August 2023 | 8.0.30 |
| CVE-2023-3823 Security issue with external entity loading in XML without enabling it | HIGH | 8.6 | 5 August 2023 | 8.0.30 |
| CVE-2023-0662 DoS vulnerability when parsing multipart request body | HIGH | 7.5 | 15 February 2023 | 8.0.28 |
| CVE-2024-5458 Filter bypass in filter_var (FILTER_VALIDATE_URL) | MEDIUM | 5.3 | 9 June 2024 | no fixed version published |
| CVE-2023-3247 Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP | LOW | - | 12 June 2023 | 8.0.29 |
| CVE-2023-0567 BCrypt hashes erroneously validate if the salt is cut short by `$` | LOW | - | 15 February 2023 | 8.0.28 |
The PHP security advisories StackDrift reads stop listing a release once it reaches end of life, and do not reach back far enough to cover every older one, so PHP 8.0 is not fully checked against them. An empty list here is not a clean result.
A further 1 advisories publish no version range, so whether they reach 8.0 cannot be determined from the advisory alone.
Where to move next
The newest tracked release is 8.5.12. If moving release is not an option yet, 8.0.30 is the newest build on the 8.0 line and needs no migration.
Other PHP releases
Vendor sources last checked 23 October 2026, and checked daily. This data last changed on 23 October 2026.
Be told before PHP 8.0 runs out
One email, ahead of the date, and nothing else. No account, no newsletter, and every message carries a link that stops them for good.
You just looked this up by hand, for one version
You had to already know you were running this version to search for it. StackDrift scans your machines and works that out for you, across every runtime, operating system and kernel underneath your code, then mails you before the next support window closes or a CVE lands on a build you have deployed.
A card is needed to open the trial and nothing is charged until it ends.