So Outside Technology Security CMS
AnQiCMS
Online Demonstration

Which versions of PHP are still within the security repair window, and which version should the site target?

📅 2026-11-01 👁️ 0

What are the versions of PHP still within the security fix window? According to the official support cycle page, there are four branches: 8.2, 8.3, 8.4, 8.5;Each branch has two years of full support starting from the initial stable version, followed by two more years of handling only critical security issues.The site should list which version as the target, depending on when this timeline breaks: as soon as the only security fix window for a branch expires, vulnerabilities exposed after that will no longer have official patches, and PHP sites running on it will continue to accumulate risks.

How to calculate the support cycle

The rule itself is very simple: after the initial stable version is released, it enters a two-year active support period, where bugs and security issues are fixed in regular version updates; after two years, it transitions to a two-year only security repair period, dealing only with critical security issues; once this line is completed, the branch will be out of the support window. For site operations, what truly needs to be watched is the second time point, that is, the deadline for only security repair of the branch.

Which branch is currently in which window

The table is organized according to the criteria provided by the official page in October 2026 (the end of active support and security support are both the end of the corresponding year):

Branch End of active support Only security fixes are available Meaning on the site side
8.2 Over End of 2026 The last follow-up of the year, no longer guaranteed thereafter
8.3 Over End of 2027 Only key security fixes are accepted, no longer handle functional issues
8.4 End of 2026 End of 2028 Can still be placed in the active update window
8.5 End of 2027 By the end of 2029 The default candidate for a new site

When determining the target version, you can proceed in three steps: first, see how long it has been since the security fix deadline of the currently running branch; second, look at the switchable branches provided by the host or image; finally, confirm how long it takes to verify the compatibility of the application and extensions on the new branch. For branches with a window of less than one year, it should directly enter the migration plan instead of waiting for an alert.

Why is the deadline a security event for the site

Content management sites treat the end-of-life date of the runtime version as an item on the risk calendar because CMS handles external controllable inputs: forms, messages, uploads, and query parameters all go through the language runtime. After the runtime falls out of support, the time that the same vulnerability can be exploited in the ecosystem will be significantly extended, and there will be no patches available on the site side.

It is necessary to check three types of environments simultaneously: the language runtime itself, the web server and reverse proxy, and the hosting environment of the program (panel or container image). If any of these fall out of the support window, the risk will fall on the site.

Which dependencies can be reduced by changing the runtime model

If you don't want to track the patch calendar of the language runtime for a long time, you can remove the runtime from the list of dependencies. AnQiCMS is developed based on GoLang, the technology stack is GoLang plus Iris framework and GORM data access layer, the delivery form is a single compiled program, which does not require a language interpreter to reside on the server; the official memory usage is about 80% lower than that of PHP class CMS, and the server specifications can therefore be reduced.

The environment on the deployment side still needs to be maintained, but the tracking object becomes an image and port: The official provides the Docker image anqicms/anqicms, and also supports one-click deployment with Baota panel or aaPanel, and LNMP command deployment, the service listens to port 8001 by default. The tracking needs to change from 'PHP branch lifecycle' to 'image version update', with a smaller scope and clearer actions.

Common questions

What should you do for sites still on the 8.1 or earlier branch?These branches have already fallen out of the support window, and should be prioritized to migrate to versions still in the security support period before discussing feature upgrades.

Will upgrading PHP affect the CMS?Yes, it is necessary to verify the extension and script behavior in the test environment; the migration window should be arranged according to the low traffic of the site and a backup point should be left first.

Can I completely ignore patches if I do not choose the PHP technology stack?No, the operating system, web server, and container images still need to be followed up on, but only the language runtime layer is missing.

Related articles

Where are the differences between the free and authorized versions of the open-source website building system, and what authorization terms should be checked?

The free and commercial open-source website building system may also be accompanied by constraints such as domain authorization and copyright identification. This article analyzes the three common authorization models, lists the four rights that must be confirmed word by word in the terms, and explains the differences between free and zero cost, as well as how to estimate the hosting and operation and maintenance expenses on the self-hosting side.

2026-11-01

Where are the common mistakes in configuring hreflang for multilingual sites, and will it affect indexing?

Language version labeling itself cannot improve ranking, and when it is misconfigured, it may even cause search engines to read the version relationship incorrectly. This article lists the five most common hreflang errors on multilingual sites, explains the performance and correction actions of each type, and gives the correct arrangement with multilingual site configuration, 301 redirect, and sitemap.

2026-11-01

AI abstracts will significantly reduce the click-through rate of the top position, should content sites still focus on ranking words?

A study covering 300,000 keywords shows that the average click-through rate is low by 58% when AI summaries appear. This does not mean that the ranking words have lost their meaning, but rather that their indicative role has changed. This article explains why ranking indicators can be distorted, how the keyword library should be re-maintained according to intent, and that the site map and llms.txt solve accessibility issues rather than citation.

2026-11-01

The WordPress test version has been released, should the site owner pre-verify it?

WordPress 7.2 Beta 1 was released on October 20, 2026, and the official statement clearly states that it is for testing and development purposes only and should not be installed on production sites. This article explains the correct pre-validation approach for the site owner: how to verify which objects in an isolated environment, how to list the verification checklist, how to convert the results into launch judgment, and the role of draft and pending publication states in grayscale validation.

2026-11-01

Only a few hours elapsed from the publication of a vulnerability to its mass exploitation, is the conventional patch window still sufficient?

In accordance with the public white paper, the WordPress ecosystem has added more than 11,000 new vulnerabilities in one year, the vast majority of which come from plugins and themes, with only a few from the core layer; vulnerabilities that are exploited collectively are only a few hours from the median announcement to mass exploitation. This shows that the patching rhythm scheduled on a quarterly basis has become incompatible with the current threat speed. This article proposes an alternative rhythm (weekly checks and changes with backup), and explains why it is still necessary to rotate credentials and change passwords after the current version fixes high-risk issues.

2026-11-01

The incident of the content management system site being poisoned in batches indicates what else needs to be paid attention to in the hosting environment.

An open web page poisoning event shows that attackers gained unauthorized access to the management interface credentials through SQL injection and then bulkly modified the output of more than seven hundred site pages. Such events indicate that the risk is not only in the program version: the exposure surface of management credentials, the scope of interface domains, and the reliability of backups all decide whether it can be cleanly recovered after being attacked. This article gives poisoning detection signals and reinforcement order.

2026-11-01

When selecting an enterprise website, should you look at the permissions first or the number of templates first

The selection of a corporate website should first consider whether the permission and content model can accommodate the organizational structure, and then look at the number of templates. The template determines the starting point of appearance, but the division of departmental work, manuscript approval, membership and access control of different user groups, as well as the structure of business fields such as products and cases, determine whether the site can continue to operate after going online. This article gives the sequence of verification according to the organizational structure and the self-inspection list.

2026-11-01

How to read the update log of the content management system to judge the risk level

To judge the risk of reading the update log of the content management system, you can look at four signals: whether the entry belongs to a security fix, whether it specifies the scope of impact and triggering conditions, whether it requires actions other than upgrades, and whether the issue to be fixed requires authentication. This article proposes a grading method, placing versions with credential rotation requirements at the forefront, and explains how to use draft and pending release states for gray scaling in upgrade decisions, and how to use backups as a safety net.

2026-11-01