Patched

Two critical PHP remote code execution flaws (CVE-2026-109618, CVE-2026-109619) are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. ForgeKit ships them out of the box.

← All guides

Guide · Last updated: November 2026

PHP 8.2 End of Life: What XAMPP Users Should Do Before 31 December 2026

If you installed XAMPP any time between November 2023 and October 2026, you're on PHP 8.2, and PHP 8.2 stops getting security fixes on 31 December 2026. Here's whether that matters on your own computer, what already needs newer PHP, and how to move to the new XAMPP without losing projects or databases.

The short answer

  • PHP 8.2 gets security fixes until 31 December 2026, then none. php.net's advice for end-of-life versions: "upgrade as soon as possible".
  • XAMPP 8.2.12 is what you have if you installed XAMPP for Windows between November 2023 and 23 October 2026. That day, XAMPP released versions with PHP 8.3, 8.4 and 8.5.
  • On your own computer the security risk is small, as long as XAMPP isn't reachable from other machines. The bigger reasons to move are frameworks that already need newer PHP, and matching the PHP version your live server runs.
  • Moving is a reinstall: new XAMPP in a new folder, copy your projects, export and import your databases. Below, step by step.

Does PHP 8.2 end of life matter on your own computer?

Less than the phrase suggests, but it's not nothing.

  • What actually stops: php.net supports each PHP version with two years of bug fixes and two years of security fixes. After 31 December 2026, newly found vulnerabilities in PHP 8.2 won't be fixed.
  • Locally, exposure is limited. A development server that only answers your own machine isn't a target in the way a public website is. If you've opened XAMPP to your network or the internet, that changes.
  • The live server is what matters most. If your hosting runs PHP 8.2, that's where end of life bites. Most hosts move customers to newer versions, and your local setup should follow, or you'll be testing on a different PHP from the one your site runs on.

In short: no need to panic on 1 January, but do plan the move in the next few months.

What already needs newer PHP than 8.2

SoftwarePHP it needsRuns on XAMPP 8.2?
Laravel 13 (March 2026)8.3 to 8.5No
Symfony 8.0 (November 2025)8.4 or newerNo
WordPress 7.17.4 to 8.5Yes

Sources: Laravel 13 release notes, Symfony 8.0, WordPress PHP compatibility. Checked 2 November 2026.

WordPress sites aren't forced to move yet. New Laravel and Symfony projects already are, and more Composer packages will follow as 8.2 drops out of support.

Moving from XAMPP 8.2 to XAMPP 8.5, step by step

There's no in-place upgrade, and the database server also jumps from MariaDB 10.4 to 10.11. So the safe route is a fresh install next to the old one, then an export and import. Keep the old folder until everything works.

  1. Export your databases. In phpMyAdmin, use Export on each database you need. Or from a terminal: C:\xampp\mysql\bin\mysqldump -u root --databases shop blog > C:\backup\databases.sql (list your own database names; add -p if root has a password).
  2. Note your changes. Copy anything you edited: apache\conf\extra\httpd-vhosts.conf, the extensions you turned on in php\php.ini, and phpMyAdmin\config.inc.php if you changed it. Your Windows hosts file entries stay as they are.
  3. Stop the old XAMPP. Stop Apache and MySQL in the Control Panel. If you installed them as Windows services, untick the service boxes first.
  4. Install XAMPP 8.5.12 into a new folder, such as C:\xampp85, from apachefriends.org. Don't install over the old one.
  5. Bring your projects across. Copy the folders from the old htdocs, or point your virtual hosts at where they already are. Re-apply your vhost and php.ini changes, including extensions such as intl, gd or zip if you use them.
  6. Import your databases. Start MySQL in the new Control Panel, then use Import in phpMyAdmin, or: C:\xampp85\mysql\bin\mysql -u root < C:\backup\databases.sql. Recreate any database users your projects log in with.
  7. Test every site and watch apache\logs\error.log and your app's own logs. Code from the PHP 7 era and old plugins are the usual source of deprecation warnings and errors on 8.5.

Only one XAMPP can run at a time on the default ports, so stop one before starting the other. Once everything works on 8.5, you can delete the old folder.

When some projects can't move yet

Often one old project, a client site or an old plugin, isn't ready for PHP 8.5, while everything new needs it. Your options:

  • Keep both XAMPPs and switch between them. Stop one, start the other. Simple, but you can't have both projects open at once.
  • Add a second PHP version to one XAMPP through FastCGI. It works, but you start and manage the extra PHP process yourself. The multiple PHP versions guide shows how.
  • Use a tool that runs versions side by side. ForgeKit (made by me) runs PHP 7.4 to 8.5 at the same time, each site on the version it needs, under Apache or Nginx with MySQL or MariaDB. Free, including for commercial work. Your projects can stay where they are, and XAMPP can stay installed while you try it.

Frequently asked questions

When is PHP 8.2 end of life?

PHP 8.2 gets security fixes until 31 December 2026, according to php.net. After that it receives no fixes at all.

Which PHP version does XAMPP 8.2.12 use?

PHP 8.2.12. It was the newest XAMPP for Windows from November 2023 until 23 October 2026, when versions with PHP 8.3.36, 8.4.27 and 8.5.12 were released.

Is it dangerous to keep using PHP 8.2 locally after end of life?

The risk is small on a development machine that only your own computer can reach. The stronger reasons to move are frameworks that need newer PHP (Laravel 13 needs 8.3, Symfony 8 needs 8.4) and matching the PHP version of your live server.

How do I upgrade XAMPP from PHP 8.2 to 8.5?

There's no in-place upgrade. Export your databases, install XAMPP 8.5.12 into a new folder, copy your projects and settings across, import the databases and test each site. Keep the old folder until everything works.

Can I keep PHP 8.2 for one project and use 8.5 for others?

Yes: keep two XAMPP installs and switch between them, add a second PHP version to one XAMPP through FastCGI, or use a tool such as ForgeKit that runs several PHP versions side by side.

Move to PHP 8.5 without leaving PHP 8.2 behind

ForgeKit is a free, native Windows environment that runs several PHP versions side by side, so the old project keeps working while the new one runs on 8.5.