Only Laravel 12 and 13 get security fixes, and 12 loses them on 24 February 2027. Here are the bug-fix and security-fix end dates for every release since 5.5, how to check yours, and what running past them looks like.
As of November 2026, two Laravel versions are supported. Laravel 13 gets bug fixes and security fixes. Laravel 12 gets security fixes only, until 24 February 2027. Everything from 11 down has reached end of life. If you're on 12, the February date is the one to put in the calendar: it's about 15 weeks away.
The dates below come from the support policy in Laravel's release notes. Versions that have dropped out of the current notes are taken from the older release notes for Laravel 6, 8 and 10, which list them.
Laravel version support dates, release by release
Bug fixes stop first. Under the current policy, security fixes carry on for six more months, then stop too.
| Version | Released | Bug fixes until | Security fixes until | PHP |
|---|---|---|---|---|
| 13 | 17 Mar 2026 | Q3 2027 | 17 Mar 2028 | 8.3 to 8.5 |
| 12 | 24 Feb 2025 | 13 Aug 2026 | 24 Feb 2027 | 8.2 to 8.5 |
| 11 | 12 Mar 2024 | 3 Sep 2025 | 12 Mar 2026 | 8.2 to 8.4 |
| 10 | 14 Feb 2023 | 6 Aug 2024 | 4 Feb 2025 | 8.1 to 8.3 |
| 9 | 8 Feb 2022 | 8 Aug 2023 | 6 Feb 2024 | 8.0 to 8.2 |
| 8 | 8 Sep 2020 | 26 Jul 2022 | 24 Jan 2023 | 7.3 to 8.1 |
| 7 | 3 Mar 2020 | 6 Oct 2020 | 3 Mar 2021 | 7.2 to 8.0 |
| 6 (LTS) | 3 Sep 2019 | 25 Jan 2022 | 6 Sep 2022 | 7.2 to 8.0 |
| 5.8 | 26 Feb 2019 | 26 Aug 2019 | 26 Feb 2020 | Not listed |
| 5.7 | 4 Sep 2018 | 4 Mar 2019 | 4 Sep 2019 | Not listed |
| 5.6 | 7 Feb 2018 | 7 Aug 2018 | 7 Feb 2019 | Not listed |
| 5.5 (LTS) | 30 Aug 2017 | 30 Aug 2019 | 30 Aug 2020 | Not listed |
Laravel 13's bug-fix end is given as a quarter, so expect an exact day closer to the time. The Laravel 6 release notes gave no PHP range for the 5.x releases, so the table says so rather than guess.
How to check which Laravel version you're running
On the server, in the project folder, run php artisan --version. It prints a line such as "Laravel Framework 12.40.2". The first number tells you which row of the table you're in.
No shell access? Open composer.lock and search for laravel/framework. The version line a few rows below it is what's installed. Don't rely on composer.json for this. A constraint like ^12.0 tells you the major version, not the patch release, and the patch matters more than most people think.
Supported doesn't mean patched
On 23 October 2026 a critical advisory, CVE-2026-114509, described a way past Laravel's built-in TokenGuard. On MySQL or MariaDB, a crafted credential that isn't a string could make the login lookup match the wrong user, so an attacker could act as someone else without their API token. The GitHub advisory for the TokenGuard flaw names the fixed release for each branch: 13.27.0 and 12.68.0 on the supported lines.
So an app on Laravel 12.40 is on a supported version and exposed anyway. Being supported only means a fix exists. Someone has to run composer update and deploy it.
Composer can tell you when that's overdue. The audit command checks installed packages against published security advisories and exits with code 1 when it finds a match, which makes it easy to fail a deploy on. The Composer command reference also lists a --locked option that reads the lock file instead of the vendor folder, handy when you only have a copy of the code.
What end of life looks like for Laravel 9 and older
Nothing breaks on the day. Pages load and orders come in. The change is that nobody has promised to fix the next flaw.
The October advisory shows what that means. Laravel 10 and 11 were both past their security dates, yet the advisory lists fixes for them as well, in 10.50.4 and 11.56.1. Laravel 9 got a release a week later, 9.52.23 on 30 October. Its commits add Laravel Cloud exception reporting. The TokenGuard fix isn't among them. An app on Laravel 9 that authenticates API calls with TokenGuard now has a published, critical hole with no official patch.
Backports like the one Laravel 10 got are goodwill, and goodwill has run further before. In November 2024 the fix for CVE-2024-52301 reached all the way back to Laravel 6.20.45. Two years later the line stopped at 10. Nobody can tell you where it stops next time, which is the whole problem with planning around it.
PHP has its own end dates
According to php.net, PHP 8.1 lost security support on 31 December 2025. PHP 8.2 loses it on 31 December 2026, 8.3 a year later, 8.4 at the end of 2028 and 8.5 at the end of 2029. PHP 7.4 went on 28 November 2022.
Read that next to the table above and two trouble spots appear. Laravel 10 can't go past PHP 8.3. Laravel 9 can't go past 8.2, so from January it has no supported PHP to run on at all. We covered that case in what PHP 8.2's end of life means for Laravel sites.
Where each version stands today
- Laravel 13: current. Keep up with patch releases. 13.42.0 came out on 10 November.
- Laravel 12: security fixes until 24 February 2027. Bug fixes already stopped on 13 August 2026, so a framework bug you hit now stays yours.
- Laravel 10 and 11: out of support, though both got the TokenGuard fix as a backport (11.56.1 in August, 10.50.4 in October).
- Laravel 9: out of support, short of a critical fix, and out of PHP options in seven weeks.
- Laravel 8 or older: stuck on PHP 8.1 or below. PHP 8.1 lost security support on 31 December 2025, and 8.0 on 26 November 2023.
What running an unsupported version costs
The security exposure is the obvious cost. The slower one is packages. Payment SDKs and PDF libraries keep dropping old framework constraints, so a small change, say a new card provider, turns into a fight with Composer before any real work starts.
Then there's the host. When it retires your PHP version, the upgrade stops being something you schedule and becomes something you do this week, on its timetable.
For scale, a fixed-price Laravel upgrade of one major version is $1,500. Apps on Laravel 7 or older cost more, because they are usually rebuilt on 13 side by side rather than upgraded in place.
How long a Laravel release stays supported now
Laravel moved to yearly releases with Laravel 8, which got a longer window of its own. Every release from 9 on gets 18 months of bug fixes and two years of security fixes. Before that, majors came every six months. General releases got six months of bug fixes and a year of security fixes, and long-term releases such as 5.5 and 6 got two years and three.
There's been no long-term release since 6, so there's nothing to park on. The practical effect: install a release in its launch month and you have about 24 months of security fixes. Start a project on it a year late and you have about 12.
When Laravel 14 is likely to land
The release notes say majors come "every year (~Q1)". Laravel 12 shipped on 24 February 2025 and 13 on 17 March 2026, so 14 most likely lands in the first quarter of 2027. That's our reading of the pattern, not an announced date.
If it holds, Laravel 14 arrives at about the moment Laravel 12 drops out of security support. Anyone on 12 should plan the move to 13 now, not wait for 14. Laravel 13 is covered until 17 March 2028, which is the longest runway any release offers today.
Questions about Laravel version support
Is Laravel 10 still supported?
No. Its bug fixes ended on 6 August 2024 and its security fixes on 4 February 2025. It did get a backported fix in 10.50.4 for the October 2026 TokenGuard advisory, but nothing obliges the Laravel team to do that again.
Which Laravel version is LTS?
None of the current ones. Laravel 6 was the last long-term support release, and its security fixes ended on 6 September 2022. Every release from Laravel 9 on gets the same window: 18 months of bug fixes and two years of security fixes.
Can I jump from Laravel 9 straight to 13?
You can change the version constraint in one go, but Laravel's upgrade guides are written one major at a time, from 12 to 13, from 11 to 12 and so on. Going one version per step keeps each change small enough to test and roll back, and it's how we run upgrades.
What PHP version does Laravel 13 need?
PHP 8.3, 8.4 or 8.5. Of those, 8.3 has the shortest life left: its security support ends on 31 December 2027.
Does an unsupported Laravel version stop working?
No. The app keeps running exactly as before. What stops is the promise of fixes, so the next published flaw in that version may never be patched.
