PHP 8.1.34

Apply these rules to code for PHP 8.1.34, the final release of the PHP 8.1 branch, published 2025-12-18 as a security release; the branch left security support on 2025-12-31, and upstream will ship no further security releases. Use these controls for existing applications while migrating, obtain vendor backports for runtime vulnerabilities, and use only APIs available in PHP 8.1.

Branch scope and end-of-life posture

• Build PHP 8.1 only from 8.1.34, the final 8.1 release, or from an operating-system or commercial vendor package that still backports security fixes to 8.1, and never ship an earlier 8.1 patch, which lacks the branch's last upstream fixes. Without such a vendor, newly disclosed interpreter and extension flaws stay unfixed.
• Plan and track the move to a branch that still receives upstream security releases as a security task. On the new branch, run its newest patch release and rebuild when one ships; PHP delivers security fixes only as patch releases of the branches its supported-versions page lists, which no longer include 8.1.
• Don't base new images on the official php:8.1 tags: Docker stopped building them at 8.1's end of life, so neither PHP nor their operating-system packages get fixes. Use a maintained vendor build of 8.1 until you move, and where a Dockerfile or CI matrix needs an exact version you can't check against php.net or the vendor's release notes, leave a build-failing placeholder.
• Check the runtime separately: composer audit reads composer.lock and sees neither PHP, PECL extensions, nor the OpenSSL, libxml2, and libcurl builds