# Vulnerabilities in your PHP projects, and in your PHP version.

Source: https://libwatch.com/en/ecosystems/php-composer

Ecosystem · PHP · Composer

LibWatch reads composer.json and composer.lock, checks every Packagist package and tracks the end of life of your PHP branch. Symfony, Laravel, Drupal or custom PHP: the same analysis.

[Analyze a PHP project](https://app.libwatch.com/users/sign_up?source=eco_php)

[See a sample alert](#alerte)

What LibWatch reads in the repository

- `composer.json`
- `composer.lock`

Language version: config.platform.php or require.php

Nothing else: no cloning, no code run.

What LibWatch checks

## The packages, and the layer below

Packagist packages

### Known vulnerabilities

Every package in the lockfile checked against OSV, which includes GitHub advisories.

PHP version

### End of life

The declared version is tracked: you know when it stops getting fixes.

Health

### License policy

Licenses that conflict with your project's policy are flagged.

An alert, in practice

## A Composer vulnerability, with the version that fixes it

Not 300 lines: the vulnerabilities that affect your versions, with the fixed version.

Real severity

CVSS severity and presence in the CISA KEV catalog

What to do

The fixed version, and the affected project

Where

Email, Slack, Zulip or webhook, set per project

End of life

## Where your PHP branch stands

Official php.net schedule, checked on October 22, 2026.

| Branch | Fixed version | Support | Action |
| --- | --- | --- | --- |
| 8.5 | 8.5.12 | Active · security → 2029 | Stay up to date |
| 8.4 | 8.4.27 | Active · security → 2028 | Stay up to date |
| 8.3 | 8.3.36 | Security only → 2027 | Plan the upgrade |
| 8.2 | 8.2.35 | Ends December 31, 2026 | Upgrade before year end |
| 8.1 | none | Ended December 31, 2025 | Upgrade now |

Dates checked on October 22, 2026.

Get started

## Your first report in a few minutes

No pipeline to change.

### Connect GitHub or GitLab

Self-hosted GitLab instances included.

### Choose your PHP repositories

LibWatch finds the files listed above on its own, even in a monorepo.

### Read the report, set up alerts

Exploited vulnerabilities first, fixed versions, language end of life.

## Learn more

Active alert

### PHP2Shell

Two critical vulnerabilities in the PHP engine.

[Read the advisory: PHP2Shell](/en/cve/php2shell)

Free tool

### Check a composer.lock

No account needed, instant preview.

[Try it: Check a composer.lock](/en/tools/composer-check)

End of life

### Your language too

Why LibWatch tracks your language version.

[Learn more: Your language too](/en/features/end-of-life)

Frequently asked questions

## LibWatch and PHP

### composer.lock or composer.json?

Both. composer.lock gives the exact versions; composer.json gives the expected PHP version.

### Are private Packagist and Satis supported?

Yes. A package distributed outside Packagist (Satis, Private Packagist, local repository) is identified as private: its name is never sent to a third-party service, and it stays in the project's inventory.

### Does LibWatch see the PHP version on the server?

No. It reads the version declared in composer.json (config.platform.php, otherwise require.php). It has no access to your servers.

## Your PHP projects, checked tonight.

[Analyze a project](https://app.libwatch.com/users/sign_up?source=eco_php)

Hosted in France by OVHcloud