Paul Schell
DEEN

PHP and Symfony in October 2026: security updates, end of support and what's coming in November

Published on

A busy month: besides the critical PHP vulnerability there were security updates for Symfony, several end-of-support dates are getting close, and PHP 8.6 and Symfony 8.2 arrive in November. Here is the overview and what it means for existing projects.

Security: update PHP and Symfony

First things first: since 21 October there are PHP updates fixing two critical remote code execution vulnerabilities (8.5.12, 8.4.27, 8.3.36, 8.2.35). The details are in a separate post.

On 15 October Symfony published three vulnerabilities that let a single crafted request take down a process:

  • HttpFoundation (CVE-2026-108082): a crafted Cache-Control header costs almost a second of CPU per request. Affects every application that handles HTTP requests.
  • Yaml (CVE-2026-109413): deeply nested inline YAML crashes the process. This includes #[MapRequestPayload] when the Yaml component is installed and the format is not restricted.
  • ExpressionLanguage (CVE-2026-109449): deeply nested expressions crash the process, for example via #[Assert\ExpressionSyntax].

Everything is fixed in the current patch releases 5.4.54, 6.4.48, 7.4.21 and 8.1.9. A composer update symfony/* within your current version is enough.

End of support in the coming months

  • 30 November 2026: Symfony 6.4 moves to security fixes only (until November 2027).
  • 31 December 2026: PHP 8.2 stops receiving security fixes.
  • 31 December 2026: PHP 8.4 moves to security fixes only (until the end of 2028).
  • 31 January 2027: Symfony 8.1 reaches end of life. Symfony 8.0 has been unsupported since July 2026.

Current dates are listed on php.net/supported-versions.php and symfony.com/releases.

New in November: PHP 8.6 and Symfony 8.2

PHP 8.6 is scheduled for 19 November 2026 and is available as a release candidate for testing. Symfony 8.2 follows at the end of November and is maintained until July 2027. From the Symfony blog of the last weeks:

  • A new JsonSchema component
  • Signed Messenger transports with secret rotation
  • Support for HTTP trailers
  • Safer HTML in translations

What it means for existing projects

  • If your project runs on PHP 8.2, now is the time to move to 8.3 or 8.4. Symfony 6.4 and 7.4 run on both.
  • Symfony 8.0 and 8.1 are short-lived releases. If you are on one of them, move to 8.2 by the end of January or deliberately stay on 7.4 LTS, which gets security fixes until November 2029.
  • Symfony 6.4 is safe until November 2027, but now is a calm moment to plan the move to 7.4 LTS. Fixing deprecations while still on 6.4 makes that step much smaller.
  • Nobody needs PHP 8.6 right away. Adding an 8.6 job to your CI is worth it, though, to see deprecations early.

Sources

Related services: Symfony upgrade PHP migration Symfony maintenance

All posts Subscribe via RSS