An emergency PHP security release, PHP 8.2 reaching end of support in December, and Python strengthening its lead in the October 2026 TIOBE Index. Here is what business owners should take from this month's numbers.
October 2026 has been an important month for anyone running a website or business application on PHP. A critical emergency security release, an end-of-life deadline only weeks away, and fresh language popularity data all point in the same direction: unsupported software is becoming more expensive to keep, and planning your next platform decision now is cheaper than making it in an emergency.
1. PHP's Emergency Security Release
On October 20, the PHP project scheduled an out-of-band release for October 21, 2026 to fix two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated CVSS 9.2. Hosting providers have urged customers to back up their sites, identify their PHP versions and update as soon as fixed builds are available. Sites on PHP 8.1 or older are on end-of-life versions that are not expected to receive an official fix.
2. PHP 8.2 Reaches End of Life on December 31, 2026
PHP 8.1 reached end-of-life on December 31, 2025, and PHP 8.2 follows on December 31, 2026. After that date, PHP 8.2 will receive no fixes — including for vulnerabilities like this month's. Anyone upgrading from an older version now should target PHP 8.4 or 8.5, not 8.2.
3. Where the PHP Ecosystem Stands
Packagist (Composer) usage data published by Stitcher.io for July 2026 shows modern versions dominate among actively maintained projects: PHP 8.4 at 32%, PHP 8.3 at 24%, PHP 8.5 at 16% and PHP 8.2 at 14%. Older versions still make up a meaningful share — PHP 7.4 at 5%, PHP 8.1 at 5% and PHP 8.0 at 1%, roughly 11% combined on versions that no longer receive updates. Since PHP 8.2 drops out of support in December, around a quarter of that sample will be on unsupported versions in January unless they upgrade.
Packagist data reflects projects that use Composer, which tend to be better maintained than the average website. The share of small business websites and older CMS installs running end-of-life PHP versions is likely higher than these numbers suggest.
4. Python Strengthens Its Lead in the TIOBE Index
In the October 2026 TIOBE Index, Python remains the most popular programming language with a rating of 19.23%, up from 17.76% in September. C rose to 11.33% in second place, with C++ at 8.87% and Java closing in at 8.41%. Julia returned to the top 20 for the first time in three years. TIOBE notes that it added Mandarin Chinese search terms this month, so some movement reflects broader data coverage rather than pure changes in developer interest. Even so, Python's position at the top is well established, driven largely by AI, data and automation work.
What This Means for Business Owners
- If you are on PHP 8.1 or older: treat an upgrade as urgent — this month's vulnerabilities will not be officially fixed for your version
- If you are on PHP 8.2: plan your upgrade to PHP 8.4 before December 31, 2026
- If your custom PHP application is old and fragile: compare the cost of upgrading against a phased rebuild in Python (Django or FastAPI)
- If AI features are on your roadmap: a Python backend makes chatbots, document processing and analytics much easier to integrate
- Whatever you choose: put a regular update process in place so the next critical release is a routine task, not an emergency
How We Can Help
Frequent Solutions offers both PHP upgrade services and PHP-to-Python migrations. We will audit your current site, tell you honestly which path makes more sense, and give you a fixed-price plan — whether that is getting you onto PHP 8.4 this month or planning a secure Python platform for next year.