Contact Us

Your Site's Last Five Years.

Pick roughly when your website or web application launched, or when it last had real development work. See what has happened to PHP and Laravel since then, year by year, from official release and security records.

When Did Your Site Last Get Real Work?

An estimate is fine. Choose the year the site went live, or the last year someone made meaningful changes to its code.

Year your site launched or last had real work

5years of changes to catch up on

2021 to today

PHP branches that reached end of life
4
New Laravel major releases
5
Security advisories highlighted below
13

Since 2021: 4 PHP branches reached end of life, 5 new Laravel major releases shipped, and this timeline highlights 13 security advisories.

2021 to Today, Year by Year

The best case for a 2021 site: if the work happened around mid-2021 on the newest versions available, it likely started here. Many sites were already a version or two behind.

  • PHP 8.0

    End of life

    No security fixes since Nov 26, 2023.

  • Laravel 8

    End of life

    No security fixes since Jan 24, 2023.

  • Newest Today

    PHP 8.5 · Laravel 13

    As of Oct 21, 2026.

  • PHP
  • Laravel
  • Security advisory

  1. 2021

  2. 2022

  3. 2023

  4. 2024

  5. 2025

  6. 2026

    • End of life

      Laravel 11 Security Fixes End

      The framework team no longer patches this version.

      Source: laravel.com for Laravel 11 Security Fixes End

    • Released

      Laravel 13 Released

      A new major release of the framework.

      Source: laravel.com for Laravel 13 Released

    • Advisory

      PHP SOAP Use-After-Free

      A use-after-free in the SOAP extension could lead to remote code execution. Fixed releases were issued for PHP 8.2.31, 8.3.31, 8.4.21, and 8.5.6.

      CVE-2026-6722

    • Advisory

      Laravel CRLF Injection in the Email Rule

      A CRLF injection in email validation could let an attacker interfere with outbound email in apps that send to user-supplied addresses. Fixed in 12.60.0 and 13.10.0.

      CVE-2026-48019

    • Security only

      Laravel 12 Bug Fixes End

      Only security fixes from here.

      Source: laravel.com for Laravel 12 Bug Fixes End

    • Advisory

      Laravel Token-Based API Guard Authentication Bypass

      On MySQL or MariaDB, a crafted credential sent to a standard token-based API guard could sign an attacker in as another existing user without that user's token. Fixed in 12.68.0 and 13.29.0.

      CVE-2026-114509

    • Advisory

      PHP RCE via Out-of-Memory Corruption

      When PHP runs out of memory at the wrong moment, it can leave internal request data half set up. The cleanup at the end of the request then treats that broken data as valid.

      CVE-2026-109618

    • Advisory

      PHP RCE via Stale Global State

      Some internal state belonging to one request can survive after its memory is freed. The next request handled by the same worker can use that stale state before PHP resets it.

      CVE-2026-109619

  7. Today

    Newest: PHP 8.5 and Laravel 13.

    A site last updated in 2021 is likely 5 Laravel major releases behind, even in the best case.

    See where your site stands

Scroll sideways, or focus the timeline and use the arrow keys.

Coming Up Next

Support windows keep closing, and these dates are already published for versions in use today.

  1. PHP 8.4 Active Support EndsSource: php.net for PHP 8.4 Active Support Ends
  2. PHP 8.2 Reaches End of LifeSource: php.net for PHP 8.2 Reaches End of Life
  3. Laravel 12 Security Fixes EndSource: laravel.com for Laravel 12 Security Fixes End
  4. PHP 8.5 Active Support EndsSource: php.net for PHP 8.5 Active Support Ends

What a Maintained Stack Typically Makes Easy

A competitor whose site runs on supported PHP and Laravel versions can typically do things an older, unmaintained site can't. None of this is a judgment of your site; it's what staying current usually buys.

Install Security Fixes as They Ship

When PHP or Laravel publishes a fix, a business on a supported version can typically install it as a routine update. Once a version reaches end of life, there is no official fix to install.

Upgrade in Small Steps

Teams that move up one major version at a time typically follow a short, documented upgrade guide, instead of facing several major versions and years of dependency changes at once.

Use Current Language Features

Supported PHP versions add features such as enumerations, readonly properties, and property hooks, which typically make code shorter, safer, and easier for a new developer to read.

Add AI Features With First-Party Tools

Laravel's current documentation includes a first-party AI SDK and MCP support, so a maintained Laravel app can likely add AI features without bolting on unfamiliar tooling.

Ship Small Changes With Confidence

Maintained applications typically have automated tests and a repeatable deployment, so small changes can go out often and be rolled back if something looks wrong.

Answer Security Questions Plainly

Customers, insurers, and auditors often ask whether your software runs on supported versions. On a maintained stack, that is likely a short, easy answer.

Sources

Release and support dates come from php.net, laravel.com, and endoflife.date. Each advisory links to its record in the National Vulnerability Database or the vendor's GitHub security advisory. Dates were last checked on Oct 21, 2026. This page can't see your site, so it doesn't say whether any advisory affects it; a read-only review can.

Find Out Where Your Site Stands Today.

The timeline shows what changed around your site. The survey asks a few questions about the site itself, so the next step can be specific to you.

Prefer to talk it through? Send us a message.

Take the Survey