Laravel 12 end of life on 24 Feb 2027: upgrade path to Laravel 13 and 14

Summary. Laravel 12 gets its last security fix on 24 February 2027, and bug fixes already stopped on 13 August 2026. The runtime can go first: PHP 8.2, the oldest version Laravel 12 supports, loses security support on 31 December 2026. Laravel 13, released on 17 March 2026, supports PHP 8.3 to 8.5 and gets security fixes until 17 March 2028. Laravel's guide estimates the 12 to 13 move at 10 minutes. Laravel 14 has no announced date. Laravel News expects Q1 2027, but it may arrive after Laravel 12's cut-off, and its master branch already requires PHP 8.4 or newer. Our recommendation: get on Laravel 12.68.0 or later today, because it carries a critical authentication fix disclosed on 19 October 2026, move to PHP 8.4 or 8.5, upgrade to Laravel 13 before February, and take Laravel 14 after its first point releases. Laravel Shift's 12 to 13 upgrade costs $19 a run, and the MIT-licensed Laravel Boost offers a free AI-guided route, apart from your AI tool's cost.

About this article. This is for developers, tech leads and agencies running Laravel 12. On 1 November 2026 we checked every date, version and price against Laravel's documentation, the laravel/framework repository and advisories, php.net, Ubuntu's archive and Laravel Shift's pages. For the regional notes we read the DPDP Act, 2023 as published, the DPDP Rules, 2025 and commencement notification dated 13 November 2025, and Article 32 of the EU and UK GDPR. Those notes are not legal advice. Laravel 14 details are pre-release, vendors change prices, and no vendor paid for inclusion. Researched with AI assistance and reviewed by our editorial team.

What is confirmed and what is not

The Laravel 12, Laravel 13 and PHP dates in this article are published and confirmed. Laravel 14 is different, so separate fact from expectation before planning around it, using Laravel News, pull request 59104 and the master branch composer.json.

Laravel's documentation does not list Laravel 14, but its master branch notes still show Laravel 13 with Q1 2026 dates, so a missing row says little about timing.

The support timeline, Laravel and PHP side by side

Every major release gets 18 months of bug fixes and 2 years of security fixes. For other first-party libraries, only the latest major receives bug fixes. The Laravel 14 row is Laravel News's projection.

PHP has its own clock: two years of active support, then two more years of security fixes.

Read the two tables together and PHP 8.4 stands out. It runs Laravel 12, 13 and the current Laravel 14 branch, with security fixes until the end of 2028. PHP 8.5 buys one more year if your extensions and packages support it. PHP 8.3 runs Laravel 13 but not the Laravel 14 branch, and its security support ends 11 weeks before Laravel 13's.

PHP 8.6 is not a target yet. PHP's timetable aims for general availability on 19 November 2026 and can still move. Laravel's table and the framework's test matrices for 13.x and master stop at 8.5, so wait until Laravel lists it.

Check what your servers ship. Ubuntu's default php package is 8.1 on 22.04 LTS, 8.3 on 24.04 LTS and 8.5 on 26.04 LTS. Laravel 12 does not support PHP 8.1, which reached end of life upstream on 31 December 2025, so a Laravel 12 app on a 22.04 server runs a non-default PHP build. Confirm who patches it.

What actually stops on 24 February 2027

Nothing breaks on the day. Your app keeps serving requests. What stops is the Laravel team shipping security patches for the 12.x branch, because the support table ends there. Your options then shrink to back-porting fixes yourself or running known-vulnerable code.

Recent advisories show what that costs. On 19 October 2026 Laravel disclosed a critical flaw: on some MySQL and MariaDB setups, an unauthenticated attacker could get past the built-in token guard and act as another user. The fixes are 12.68.0 and 13.29.0, with no 11.x fix listed. A medium-severity advisory that day covers read-only requests that could trigger destructive database operations, fixed in 12.68.0 and 13.27.0. After 24 February, a flaw like these gets no 12.x release.

PHP works the same way. The PHP2Shell flaws and their single-commit fix reached users on 21 October 2026 as 8.2.35, 8.3.36, 8.4.27 and 8.5.12. From 2027, PHP 8.2 is off that list, about eight weeks before Laravel 12 stops getting framework patches. Our PHP developer hiring guide covers the staffing side of that cut-off.

Why not wait and jump from 12 straight to 14?

Four reasons not to skip a version:

1. The date is unknown. Two of the last three majors shipped in March, and Shift's plan FAQ says majors typically arrive in March. A release on 17 March 2027 would leave Laravel 12 unpatched for three weeks before you could even start.

1. Upgrades run one version at a time. Laravel's guide covers 12 to 13 only, and Shift says its Shifts run one version at a time so you can verify each step.

1. Laravel 13 is a small step. Laravel calls it a relatively minor upgrade that most applications can make without changing much code.

1. Laravel 13 gives you runway. Security fixes run to 17 March 2028, so you can take Laravel 14 when your packages support it.

Step 1: fix PHP first, while still on Laravel 12

Laravel 12 supports PHP 8.2 to 8.5, so you can change the runtime without touching the framework. Doing it first isolates two kinds of failure and clears the 31 December deadline.

            php -v
composer check-platform-reqs
composer why-not php 8.4
composer audit
          

composer why-not lists packages that block the target PHP version. composer audit reports known advisories in installed packages, a useful baseline. If your composer.json pins config.platform.php, update it so dependency resolution matches production.

Then run the full test suite on PHP 8.4 in CI, fix deprecations, and deploy the runtime change on its own.

Step 2: Laravel 12 to 13, the changes that matter

These are the upgrade guide's changes most likely to bite in production.

The config keys are serializable_classes and serialization. The guide lists more low-impact changes, including queue event properties, helper clashes from the PHP 8.5 polyfill and domain route precedence, so read it in full. It also encourages comparing the laravel/laravel skeleton between 12.x and 13.x, since it does not list every config-file change.

CSRF. Requests the Sec-Fetch-Site header marks as same-origin now pass without a token. Anything else falls back to the token check, so ordinary forms keep working. The trap is exclusions. The old names survive as deprecated classes that extend the new middleware, the web group uses the new class, and the router's exclusion check removes an excluded class and its subclasses, not its parent. On our reading of that code, a route that still excludes VerifyCsrfToken keeps its CSRF check on Laravel 13, so a webhook relying on that exclusion would start failing. We read this in the source and did not run it, so confirm it on staging.

Prefixes. The guide says most applications are unaffected, because their config files already set these values. If yours falls back to framework defaults, expect cache misses and logged-out users on deploy.

Three ways to run the upgrade

This table draws on Laravel's upgrade guide, Boost's licence and Shift's pricing pages.

Shift lists earlier hops at $29 for Laravel 11 to 12 and $39 for each older version. It needs write access to open a branch, says your code stays on its server only while the upgrade runs, and offers Shift for Docker if code cannot leave your network. No Laravel 14 Shift is listed yet; Shift says one joins its Latest plan when Laravel 14 ships, and the 12.x Shift leaves that plan 30 days later.

Whichever route you choose, treat the output as a pull request to review. If you are weighing AI assistants for this work, see our comparison of LLMs for coding on cost.

Step 3: testing that catches what the guide misses

A ten-minute dependency change still needs a regression pass. Start with a PHP version matrix in CI, listing only versions your composer.json allows.

            on: [push, pull_request]
jobs:
  test:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        php: ['8.4', '8.5']
    steps:
      - uses: actions/checkout@v7
      - uses: shivammathur/setup-php@v2
        with:
          php-version: ${{ matrix.php }}
      - run: composer install --no-interaction
      - run: cp .env.example .env && php artisan key:generate
      - run: php artisan test
          

Then:

1. Test CSRF with real requests. The new middleware skips its checks during unit tests, so a passing feature test proves little. On staging, send cross-site POSTs and hit excluded webhook routes.

1. Cover the other high-impact changes. Check sessions across a deploy, cache reads after the prefix change, and queue listeners that read event properties.

1. Watch for test-suite changes. Laravel 13 resets custom Str factories between tests and changes the default password-reset subject, which can break assertions.

1. Stage with production-like data. Run migrations, queue workers and scheduled tasks against a copy of real data.

1. Plan the rollback. Explicit cache prefixes and session serialization left at php make it easier to roll back without logging users out.

Step 4: preparing for Laravel 14 now

Laravel News tracks changes merged to the master branch. They are not final, but they show what to avoid relying on.

Master also requires Symfony 8.1 components, while Laravel 13 accepts Symfony 7.4 or 8. Today, standardise on PHP 8.4 or 8.5, search the codebase for the methods above, and ask key package vendors when they plan Symfony 8 support.

Pick your path

Worked example: an agency with 12 Laravel 12 apps

Assume an agency maintains 12 client apps on Laravel 12, half of them on PHP 8.2. Prices are Shift's on 1 November 2026.

Tooling cost with Shift:

• Laravel 13.x Shift for every app: 12 × $19 = $228

• With the optional AI Review: 12 × ($19 + $9) = $336

• Latest plan per repository: 12 × $99 = $1,188 a year

• Latest plan with unlimited repositories: $899 a year, the cheaper subscription at this size

For a single hop, per-Shift pricing is far cheaper. A plan pays off only if you also want Shift's weekly and monthly pull requests.

Engineering time, the real cost. As an illustrative assumption, say each app needs one engineer-day for review, testing and deployment, and the six PHP 8.2 apps need another half-day each for the runtime change. That is 12 + (6 × 0.5) = 15 engineer-days. Over the roughly ten working weeks from 1 December 2026 to 12 February 2027, that is 15 ÷ 10 = 1.5 engineer-days a week. Do the six runtime moves first: 6 × 0.5 = 3 engineer-days, which fits inside December at that pace and clears the 31 December deadline.

India, EU and US notes

India. Section 8(5) of the DPDP Act, 2023 requires data fiduciaries to take reasonable security safeguards to prevent personal data breaches, with a penalty of up to ₹250 crore. Section 8 and Rule 6 start eighteen months after the 13 November 2025 gazette, which computes to about 13 May 2027. Rule 6 does not name software versions, but our reading is that an unsupported framework or PHP version would be hard to defend under that duty. Our DPDP Rules checklist covers the wider controls. On managed or shared hosting, confirm your host offers PHP 8.4 or 8.5 before you plan dates.

EU and UK. Article 32 of the GDPR and of the UK GDPR requires security appropriate to the risk. Neither names software versions, but an unpatched framework is a weak position, and a dated upgrade plan helps in reviews.

US. CISA's Bad Practices list calls unsupported software dangerous in critical infrastructure and national critical functions. Expect enterprise security questionnaires to ask about supported frameworks and runtimes, and have both dates ready.

How eCorpIT can help

eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our Laravel development team takes on scoped upgrades, from PHP runtime moves and Laravel 12 to 13 upgrades to regression suites and CI version matrices. Talk to us at /contact-us/.

Last updated: 1 November 2026.

References

1. Release notes 13.x: versioning scheme and support policy — Laravel

1. Supported versions — PHP

1. Upgrade guide: upgrading to 13.0 from 12.x — Laravel

1. What We Know About Laravel 14, 21 September 2026 — Laravel News

1. composer.json, master branch — laravel/framework on GitHub

1. Token-based API guard Auth Bypass, GHSA-f9x3-7vq9-cph6, 19 October 2026 — laravel/framework on GitHub

1. All Shifts and prices — Laravel Shift

1. Laravel Boost MIT licence — laravel/boost on GitHub

1. Prepare master branch for Laravel 14, pull request 59104 — laravel/framework on GitHub

1. Release notes, master branch documentation — Laravel

1. PHP 8.6 preparation tasks and timetable — PHP wiki

1. Test workflow, 13.x branch — laravel/framework on GitHub

1. Test workflow, master branch — laravel/framework on GitHub

1. php package versions by release — Ubuntu Packages

1. Unsupported branches — PHP

1. Unauthorized Data Destruction, GHSA-5wcm-3v2w-8362, 19 October 2026 — laravel/framework on GitHub

1. Release data for PHP 8 — PHP

1. PHP 8 ChangeLog — PHP

1. Shifty Plans — Laravel Shift

1. Pricing and how it works — Laravel Shift

1. Command-line interface — Composer

1. Config: platform — Composer

1. CSRF protection, 13.x — Laravel

1. VerifyCsrfToken.php, 13.x branch — laravel/framework on GitHub

1. Foundation Configuration Middleware.php, 13.x branch — laravel/framework on GitHub

1. Router.php, 13.x branch — laravel/framework on GitHub

1. Frequently asked questions — Laravel Shift

1. PreventRequestForgery.php, 13.x branch — laravel/framework on GitHub

1. composer.json, 13.x branch — laravel/framework on GitHub

1. Digital Personal Data Protection Act, 2023 (No. 22 of 2023), 11 August 2023 — Ministry of Electronics and Information Technology

1. Commencement notification, G.S.R. 843(E), 13 November 2025 — Ministry of Electronics and Information Technology

1. Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), 13 November 2025 — Ministry of Electronics and Information Technology

1. Regulation (EU) 2016/679, Article 32 — EUR-Lex

1. UK GDPR, Article 32 — legislation.gov.uk

1. Bad Practices — Cybersecurity and Infrastructure Security Agency