So Outside Technology Security CMS
AnQiCMS
Online Demonstration

After the PHP version enters the stage of only fixing security issues, when should the site be upgraded at the latest?

📅 2026-11-01 👁️ 0

After the PHP branch enters the stage of only fixing security issues, the latest deadline for the site to complete the major version upgrade is the end of security support for that branch, for example, security support for 8.2 ends on December 31, 2026. A more practical judgment is to treat the deadline as a bottom line rather than a plan; when entering the only security stage, the upgrade schedule should be initiated because the later it is done, the smaller the available patch window is.

How to read the two phases of the official lifecycle

PHP's support policy is clear: each branch is actively supported for two years since its official release, during which defects and security issues will be fixed and released with regular point releases; after the active period ends, the branch will receive another two years of support, but only for critical security issues.

The difference between the two stages is very significant in actual operations. During the active period, you can wait for routine point releases, and compatibility issues and non-critical defects will be addressed together; after entering the security-only phase, point releases are arranged as needed, and only security fixes will be released, and issues encountered by the business side must be borne by themselves. Therefore, 'still receiving patches' does not mean 'still in the support period'.

The deadline window of each branch

As of the current statement on the official support page:

Branch Active support ends Security support ends
8.2 2024-12-31 2026-12-31
8.3 2025-12-31 2027-12-31
8.4 2026-12-31 2028-12-31
8.5 2027-12-31 2029-12-31

The branch in the only security stage, the remaining time is its patch lifespan. 8.2 is now in this stage, and security support will end by the end of this year. Sites still running on 8.2 need to complete the migration within this year.

Three things to verify before upgrading.

The first is extensions and dependencies. List the actual extensions used by the site and confirm each one is available in the target major version; also check the minimum version requirements for frameworks and libraries, as many compatibility issues arise from dependencies rather than the code itself.

The second is the difference in behavior and regression. There are often semantic changes between major versions, and it is not enough to just check if the page is normal. You need to run the main chain of order, login, upload, form submission, etc., and observe the error logs for a period of time.

The third is the way caching and running services take effect. The loading time of opcode cache and user configuration files is easy to go wrong after version switching. After switching versions, confirm that the actual running worker is using the new interpreter, and restart all processes if necessary. Do not let some processes continue to run the old version.

The deployment method affects the cost of upgrading.

The same runtime environment replacement shows a significant difference in workload under different deployment methods. Switching PHP versions in Baota panel or aaPanel is an interface operation, it can be rolled back, and there is a version list;The LNMP command-line deployment requires the installation of the target version manually and adjustment of the site configuration; Docker image deployment modifies the image tag and orchestration file, providing stronger environment consistency and direct rollback.AnQiCMS is developed based on GoLang, the technology stack is GoLang plus Iris framework and GORM, the runtime does not require a PHP interpreter, therefore there is no part of the workload that frequently changes the runtime environment according to the PHP lifecycle;The PHP application is still running on the same server, schedule separately according to the above window.

Common questions

What will happen if you continue to run the old version after the end of security support?New vulnerabilities will no longer have targeted patches, and the exposure surface of the site will increase linearly over time; the operating system source may also stop providing this version, at that time, it will be difficult to continue with basic dependencies.

Can you jump directly from 8.2 to 8.5?Yes, but don't expect to succeed in one go. Jumping across multiple major versions means that you need to digest several rounds of behavioral changes at the same time, and the safe way is to verify the cross-version path in the test environment, confirm that there are no blockages before directly going to the target version.

What security actions do you need to take after the upgrade?Answer: Review the configuration items related to the operating environment, including the error reporting switch, upload limits, and session configuration, and update the site credentials as needed to avoid continuing to use old configurations exposed during the switching process.

Related articles

After enabling pseudo-static, the links with query parameters jump to the wrong page, which URLs should be tested before going online?

The static alias modifies the address resolution entry, and if the rules are mistakenly damaged, the first problem to appear is with links containing query parameters, pagination, tag pages, and Chinese paths. There are similar repair records in the update logs of third-party open-source systems. This article provides the five types of links that must be tested before going online, the configuration order and rollback method of custom static alias rules, as well as which link to fix first when enabled simultaneously with the 301 redirect.

2026-11-01

When replacing the content in bulk on the entire site, which fields need to be backed up before they are changed?

Before using the bulk replacement function to change content on the entire site, it is recommended to back up three types of objects: document data (including static files), template files, and navigation and watermark configurations. Keywords and links in the text can be covered by the recycle bin and piece-by-piece rollback, but once configuration items such as navigation, watermark, and template are overwritten, there is no ready-made recovery entry. Take a snapshot before replacement and confirm the correct scope after replacement with front-end inspection.

2026-11-01

Migrating from a hosting website building platform to a self-built content system, how to arrange the migration sequence to avoid losing indexing

Migrating in a fixed sequence ensures not losing indexing: First export the content list and make a complete backup, then use ZIP compression packages or Excel spreadsheets to batch import content. When importing, check for duplicate titles to avoid repeated搬运, and finally, set up 301 redirect mappings for old addresses and observe for two weeks. This article provides the key operational points and verification methods for each step, covering the backup scope of data and static files and the usage standards of the import interface.

2026-11-01

Batch migrating old website articles, is it more stable to import using a compressed package or a table?

The old site articles are moved in bulk, the choice between ZIP compressed package import and Excel table import depends on whether there are attachments and field structure: The migration of image static files and graphics goes through the compressed package, while batch creation of articles goes through field mapping. AnQiCMS also provides the import/archive import interface, which supports querying whether the title already exists, and can be checked before repeated import.

2026-11-01

How should the arrangement of multi-language for cross-border e-commerce websites, and the steps of full page translation and language switching be arranged?

The order should be to define the site structure first, then translate the content, and finally configure the switch entry. The structure selection determines all subsequent work: whether it is a multilingual site or a site segmented by market, it directly affects the domain, content, and maintenance boundaries. The full-page HTML translation can cover the text, but template copy, glossary, and product attributes need to be reviewed separately; the switch entry should be released only after the language version can be verified to avoid visitors switching to a half-translated page.

2026-11-01

The PHP branch only has two years of active support, how should the site's runtime environment upgrade be scheduled?

The PHP official policy is to provide full support for each branch starting from the stable version, and then handle only critical security issues as needed for the next two years. According to the deadline on the current page, 8.2 to December 31, 2026, 8.3 to the same year in 2027, 8.4 to 2028, 8.5 to 2029. The site scheduling should separate these two stages and leave at least one complete regression cycle, and do not wait until the patch stops before starting.

2026-11-01

The content system's major version at the end of the year is set for December 8, how to arrange the upgrade window for hosted sites

The end-of-year major version is set to be around December 8th, and the upgrade window needs to be arranged in three layers: first, confirm whether there are any must-now-be-fixed security patches for the current period, then leave the major version for the rollback period during the business low-peak time, and finally allocate time for panel restart and dependency readiness for the托管 environment. The sequence is wrong, which may lead to the situation where security items are delayed and no one handles them during the holiday.

2026-11-01

Does the content system listen to port 8001 by default, and should it be changed when deploying reverse proxy?

When the default listening port is 8001, if there is a reverse proxy in front, there is no need to change the program port to 80 or 443. What needs to be changed is the forwarding target and site address configuration on the proxy side, so that external access can be made through standard ports, while the program port is limited internally. The real check is whether the port is directly exposed, whether the static resource path and redirection are correct.

2026-11-01