Hacker News Reader

Comment by pier25 | Hacker News Reader

Apparently about 40% of PHP apps are still on PHP 7 and 5...

There are rare occasions when circumstances are more important than preserving an "EOL" designation. This appears to be one of those times where "official" centralized patches really should be made available for at least PHP5.6 and PHP7.4, and perhaps even 5.5 and all of 7.x. They're not covering themselves in glory by refusing.

That's going to give a lot of people a moment of reflection about whether or not they want to continue using PHP.

Yes and no, you have two setup, you're on LTS, it will be backported (done as I write than on Debian), not on LTS and you already have hundreds of unsafe stuff running anyway so it's just one more to the pile.

I would think most people that are stuck on EOL PHP probably don't have a choice

Yeah, I have a legacy site that is popular and doesn't make money with some outdated version of PHP that will not update. Maybe I need to install OpenClaw on it.

But yeah, with AI agents, I don't really understand the purpose anymore. Legacy WordPress or laravel sites?

If those place at using a LTS release of their OSes they will be patched quickly (Debian already has). If they're not, they're already screwed by a lot more than just PHP I guess.

Those websites can easily run in a php5 container, whilst the host os is up to date.

Websites depending on an older framework like Zend Framework or libraries like Doctrine 1 do not have a clear upgrade path and are stuck at php5 or have to basically start from scratch. php5 to the latest php8 is just a jump too big.

Yes and in general lots of users being on unsupported releases should also cause som reflection why that is. E.g. maybe support periods are too short or there are too many breaking changes with new releases.

It looksl ike they released official patches at least for 7.4 though:

> Given the severity of these vulnerabilities, the PHP security team provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to help people building from source or without access to an LTS vendor.

https://github.com/php/php-src/tree/PHP-7.4-CVE-2026-109618-...

I see Debian has packages.

5.6.40-104+0~20261021.134+debian12~1.gbp7401dd

7.4.33-31+0~20261021.121+debian12~1.gbpe9c428

Reply on news.ycombinator.com