Each PHP release is faster than the last and receives security fixes for about three years. The only reason not to run a supported version is that something you depend on does not work on it - which is a question with an answer, not a guess.

The support window is the floor

  • Active support: bug fixes and security fixes, about two years.
  • Security support: security only, one more year.
  • After that: nothing, ever. A known flaw stays open on your server for good.
Running an unsupported version is not a maintenance choice, it is an open door. It is also one of the first things an automated scan checks for.

Check before you switch

composer why-not php 8.3
vendor/bin/rector process --dry-run
phpcs --standard=PHPCompatibility --runtime-set testVersion 8.3 app/

The first line names the packages that hold you back. Often it is one abandoned library, and replacing it is smaller work than staying behind forever.

If a CMS is involved

Check the compatibility page for the core and for every plugin. A plugin that has not been updated in three years is the reason you are stuck, and it is also a security problem in its own right.

Switching, safely

  1. Take a backup — see back up before every update.
  2. Change staging first — and exercise checkout, uploads, mail and the cron jobs.
  3. Switch production, keeping the old version installed — so going back is one line.
  4. Watch the error log for a day — deprecation notices arrive in traffic, not in tests.

And the version your cron jobs use

php -v                                    # the CLI
curl -sSI https://yourdomain.com | grep -i x-powered-by
The CLI and the web version are separate settings. A nightly job on an old version while the site runs a new one produces failures that only ever happen at night - see keeping PHP patched.