So PHP 7.4 will have security support from the PHP project until the 28th Nov 2022 and then will reach End of Life.

Yet, Debian Bullseye, a stable release, is quite new still and have PHP 7.4 as a package.

Then, what happens after the deadline for 7.4 with Debian instances deployed?

I would be interested in knowing more about what happens with any packages reaching EOL while in a Debian stable, if such documentation exists.

1 Answer 1


I’m not sure this is documented anywhere in a generic way.

In practice, the most likely outcome is that the PHP maintainers will try to continue providing security support on their own. You can see this happen in Debian 10: a fix was backported from 7.4 to 7.3 (although that happened before the official end-of-life date for 7.3, November 18, 2021). See also PHP security updates in Debian after PHP version EOL for earlier examples.

This would mean that even after PHP 7.4 reaches its end-of-life as far as the PHP project is concerned, the Debian project will continue to provide security updates if necessary.

Another, hopefully unlikely for PHP, possibility is that PHP 7.4 packages will be added to the “limited security support” list; install debian-security-support and run check-support-status to check your own system for packages with limited security support.

Finally, in some cases new packages are allowed into a Debian release; this is the case for example with browsers. I’m not sure this is a viable approach for PHP since moving from PHP 7.4 to 8.1 (the version currently available in Debian testing, and thus a candidate for backporting) involves some migration work for applications written in PHP.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .