Still on PHP 7.4? Your image does not have to be a museum piece.
php.net stopped shipping security fixes for PHP 7.4 in 2022, for 8.0 in 2023 and for 8.1 at the end of 2025 — and the official container images stopped with them. If your application still runs on one of those, you are not being careless. You are being realistic about what an upgrade costs.
| PHP | Security fixes from php.net | Status | We build it |
|---|---|---|---|
| 7.4 | until 28 November 2022 | ended | yes |
| 8.0 | until 26 November 2023 | ended | yes |
| 8.1 | until 31 December 2025 | ended | yes |
| 8.2 | until 31 December 2026 | active | yes |
| 8.3 | until 31 December 2027 | active | yes |
| 8.4 | until 31 December 2028 | active | yes |
| 8.5 | until 31 December 2029 | active | yes |
Less around PHP to worry about.
We cannot patch the PHP interpreter itself — nobody can once upstream stops. What we
can do is everything around it: your image carries only the extensions your
composer.lock actually needs, and those we keep current. A 2019 base
image drags along hundreds of packages that have collected vulnerabilities ever since.
Buy yourself time, honestly.
An upgrade to a supported PHP version is still the right destination. But rushing it is how a working system gets broken. A smaller, maintained image lowers the risk you carry in the meantime — so the migration happens when it is ready, not when a scanner report forces it.
The same image, one version up.
When you are ready to move, change the PHP version in your container definition and rebuild. Same extensions, same setup, one version newer — which makes trying the upgrade a small experiment instead of a project.
No judgement
See what your legacy stack would look like.
Paste the composer.lock of your oldest application on the start page and pick
its PHP version — including 7.4. You will get a pullable image in under a minute, without
an account.
Support dates are php.net's official schedule. To be explicit: running an end-of-life PHP version means the interpreter itself no longer receives security fixes, and no image can change that. What a purpose-built image changes is how much other software sits next to it — and how quickly that part gets patched.