PHP EOL support: it costs extra now

# Stay up-to-date mindset?

That was the idea when we started. Deploy with Git push, update with composer update, keep everything fresh. We wrote a post about the up-to-date mindset in 2018.

Naive in hindsight. Projects get done. The agency invoices the last milestone, the client stops answering emails, the developer moves on to the next job. The website stays. It just sits here. That is the point of a finished project. Somebody uploaded code, we keep running it. That's our business. Some apps have been running here for more than ten years. Most of them got updated along the way. Some did not. How great is it when the same website code still runs ten years later?

But then.

# PHP end of life

PHP 7.4 lost security support in November 2022, PHP 8.0 in November 2023, PHP 8.1 on the last day of 2025. PHP 8.2 follows on 31 December 2026. See php.net↗. In 2018 I looked at three sources for old PHP in the wild, and Composer users were the freshest of the lot. Same picture now. Brent's Packagist stats for July 2026↗ put 11% of installs on 7.4, 8.0 or 8.1. On our old platform, it is even more.

Our update policy used to say we remove a version once its security support ends and force-upgrade the apps still on it. We have not done that for 7.4. Hundreds of apps on 7.4 are still here. So we changed the update policy↗ to match what we do: old PHP versions stay as long as we can run them securely, provided as is, and they (may) cost extra.

# PHP2Shell

We already had the PHP EOL extra costs planned. Then came PHP2Shell in October. Two critical vulnerabilities in PHP itself. This time the PHP maintainers published fixes for 7.4, 8.0 and 8.1 too, as source code. We were lucky. There is no promise that happens again. Next time, an old version may not get a fix at all, and the only way out is an upgrade under pressure. Every fix means compiling new images for each old version.

# Updating hurts

We know. Even a minor PHP version bump can break a site when the framework below it has not been updated in years. Then the framework needs a major upgrade first, that needs a plugin that has been abandoned, and so on. Staying on old PHP can be a rational choice. Not upgrading is also the lazy route.

# The legacy support fee

From 1 December 2026, on both platforms, new and old, an environment on a PHP version past its end of life pays a monthly fee on top of the PHP component. The older the version, the higher the fee. USD is the same number as EUR.

On our side, switching takes two clicks. In the dashboard, open the PHP version setting of the environment, pick a supported version or "Latest version", and save. The fee stops. Whether the code runs on the newer version is the other half of the job: the PHP upgrade guide covers it.

# Fees from December 2026

# Fees in 2027

Every 1 January, each fee doubles, and the version that lost security support in December joins at €0.50. In 2027, that is PHP 8.2:

The current prices are in the docs.

# Fewer versions over time

The doubling does not go on forever. We want to run as few PHP versions as possible: two or three with security support, two or three without. Right now there are more. The oldest version gets retired first, and environments still on it move to the next newer version.

Not a welcome gift, I know. I know.

# What other web hosts do

We are late to this.

• IONOS↗ charges $7.81 per month for PHP 8.1 and $15.62 for 7.4, on top of a $6 entry package.
• Strato↗ adds about €5 to a €9 package and switched 8.1 to paid in March 2026.
• GoDaddy↗ sells a paid add-on with backported patches from Zend and does not publish the price.

# What we do for the money

We keep the old versions alive as long as we can. With every maintenance we rebuild them and keep the extensions on the latest release that still supports them. A serious vulnerability in an old PHP version can force us to retire it at any time. The fee does not buy a guarantee.

We are a small company, we run it differently from most big web hosts. Where the money goes is in our cost breakdown, how we work in operations.

# Thanks

To everybody who is still here after all these years with a site that works. And to everybody who upgrades now, before the first invoice lands. Both are fine with us.