In this guide · 7 sections
Short answer
List every component's version (OS, PHP or Node.js, database) and check it against the vendor's lifecycle page. As of October 2026, PHP 8.1 and MySQL 8.0 are end of life, PHP 8.2 loses security fixes on 31 December 2026 and Windows Server 2016 on 12 January 2027. Plan upgrades before those dates.
What 'end of life' means for server software
Most server software has two phases after release: active support, with bug fixes and security fixes, then security-only support, then end of life (EOL). After EOL, newly found vulnerabilities stay open. Attackers know this and scan for old versions because the holes are public and permanent.
Some vendors sell extended support beyond the normal date, such as Microsoft's Extended Security Updates for Windows Server or Canonical's Ubuntu Pro for older Ubuntu releases. That buys time; it does not remove the need to upgrade.
Key end-of-life dates to check in late 2026
These are the versions small business servers most often run. Dates are from the vendors' own pages where available, with endoflife.date as an index for the rest.
| Component | Version | Status as of 21 Oct 2026 | Source |
|---|---|---|---|
| PHP | 8.1 | End of life since 31 Dec 2025 | php.net |
| PHP | 8.2 | Security fixes only, ends 31 Dec 2026 | php.net |
| PHP | 8.3 / 8.4 | Security support to 31 Dec 2027 / 31 Dec 2028 | php.net |
| MySQL | 8.0 | End of life since April 2026; 8.4 is the current LTS | endoflife.date |
| Ubuntu | 20.04 LTS | Standard support ended May 2025; paid Ubuntu Pro to 2030 | ubuntu.com |
| Ubuntu | 22.04 LTS | Standard support ends 2027 | ubuntu.com |
| Windows Server | 2016 | Extended support ends 12 Jan 2027 | Microsoft lifecycle |
| Node.js | 20 | End of life since 30 Apr 2026 | endoflife.date |
Our guides to updating PHP on WordPress and Windows Server 2016 end of support cover two of these in detail.
How to find out what versions you are running
You need a list of every component, its exact version and its end-of-support date. For a typical Linux server running a website, this takes under an hour.
Operating system
On Ubuntu or Debian, run 'cat /etc/os-release'. On Windows Server, run 'winver' or check System in Settings.
Language runtime
Run 'php -v' or 'node -v'. For WordPress, Tools, Site Health, Info, Server shows the PHP version the site really uses, which may differ from the command line.
Database
Run 'mysql --version' or check the server version in phpMyAdmin or your database console.
Web server and panel
Note Nginx or Apache versions and any control panel such as cPanel or Plesk, which have their own lifecycles.
Application and plugins
CMS core, plugins, themes and app dependencies. Your package manager or a dependency audit tool lists outdated ones.
Record it
Put each item, version and end-of-support date in your asset inventory, with the next review date.
What Cyber Essentials expects for unsupported software
CSA's Cyber Essentials (2025) document is clear on this. The software inventory should record each item's version and end-of-support (EOS) date. Hardware and software that has reached its EOS date shall be removed. Where continued use is necessary, the organisation must assess the risk, describe the compensating controls, get senior management approval and monitor the asset until it is replaced.
It also requires critical or important updates for operating systems and applications to be prioritised and applied as soon as feasible, and suggests automatic updates for critical patches where feasible. Our Cyber Essentials mark checklist covers the rest of the requirements.
Acceptable stop-gap
- Paid extended security updates with a dated upgrade plan
- Old server isolated, behind a firewall, with no public access, while replacement is built
- Written risk acceptance signed by a director, reviewed quarterly
Not acceptable
- 'It still works' with no plan
- Public website on an EOL PHP version with no patches available
- Nobody knows what version the server runs
Plan the upgrade without breaking the site
Most upgrade failures come from plugins, extensions or custom code that relied on old behaviour, not from the new version itself. A staged approach avoids surprises.
Upgrade checklist
For an old operating system, a new server is often cleaner than an in-place upgrade: build it on a current LTS release, move the site across, then switch DNS. Our guide to software updates and patching for small businesses covers the routine that stops servers falling this far behind.
Do it yourself or get help?
If you are comfortable on the command line and have a staging copy, a PHP upgrade on a single site is a manageable job. Operating system and database upgrades, or servers nobody has documented, carry more risk.
Our Software & Server Protection Setup (S$590) includes an outdated-software report for one VPS, web app or website, alongside malware scans, firewall and automatic security updates. Server Protection Care (S$149 per server per month) applies updates monthly, checks protections, tests a restore and reports in plain English. IT Sorted is a Singapore-based team of developers with over 10 years of experience; you pay upfront, send the brief in writing and follow progress on your order page.
Frequently asked questions
Yes, over time. After end of life, newly discovered vulnerabilities in that PHP branch are not fixed, so a public website stays exposed to any flaw found later. PHP 8.1 reached end of life on 31 December 2025 and PHP 8.2 gets its final security fixes on 31 December 2026, according to php.net.
In WordPress, go to Tools, Site Health, Info, Server. On a server, run 'php -v', but note that the web server may use a different PHP version from the command line. Your hosting control panel usually shows the version per site as well.
MySQL 8.0 reached end of life in April 2026, according to the endoflife.date index of Oracle's lifecycle. MySQL 8.4 is the current long-term support release. Test your application on 8.4 in a staging copy before upgrading, because some defaults and authentication settings changed.
Cyber Essentials (2025) says assets past their end-of-support date shall be removed. If continued use is necessary, the organisation must assess the risk, document compensating controls, get senior management approval and monitor the asset until it is replaced. An undocumented old server would not meet that.
For PHP or plugin upgrades, in place on a tested staging copy is usually fine. For operating system or major database upgrades, building a new server on a current long-term release and moving the site across is often safer, because you can test fully and switch back if something fails.