PHP 7.3 End of Life
Support dates, vulnerabilities published since end of life, and upgrade guidance — rebuilt from live data.
PHP 7.3 reached end of life on 6 Dec 2021. It no longer receives security fixes.
Support timeline
Official dates from the PHP release process.
| Milestone | Date | Status |
|---|---|---|
| Initial release | 6 Dec 2018 | — |
| End of life | 6 Dec 2021 | 4.7 years ago |
| Active support ended | 6 Dec 2020 | security fixes only after this |
| Latest release | 7.3.33 · 18 Nov 2021 | final |
The cost of staying: CVEs since end of life
60 PHP vulnerabilities have been published since 6 Dec 2021. All were fixed in supported branches — 7.3 received none of them. Source: NVD.
PHP CVEs published since 7.3's EOL, by year
15 of the 60 are rated critical · data refreshed 2026-08-09
Published 21 Oct 2022 · rated critical — fixed in supported branches only, never in 7.3. Details
Published 10 Apr 2024 · rated critical — fixed in supported branches only, never in 7.3. Details
Published 9 Jun 2024 · rated critical — fixed in supported branches only, never in 7.3. Details
Where to go from 7.3
Recommended target: PHP 8.5 (supported until 31 Dec 2029).
The newest actively supported branch is PHP 8.5 (latest release 8.5.9). Review php.net before upgrading. Run composer why-not php 8.5 to check package compatibility.
Frequently asked questions
Is PHP 7.3 still safe to use?
No. PHP 7.3 stopped receiving security fixes on 6 Dec 2021. Since then, 60 PHP vulnerabilities have been published and fixed in supported branches — PHP 7.3 received none of those fixes.
Can I still download PHP 7.3?
Yes — the final release (7.3.33) generally remains available from vendor archives and OS package mirrors, but installing it means running software with known, unpatched vulnerabilities.
What should I upgrade PHP 7.3 to?
Upgrade to PHP 8.5, the newest actively supported branch (supported until 31 Dec 2029).