PHP in 2026: a language still at the heart of business applications

In 2026, PHP remains a solid choice for business applications: custom ERPs, back offices, customer portals, APIs, internal tools. The language has changed a lot since PHP 7: strict typing, enums, readonly properties, property hooks, the pipe operator. The ecosystem has matured too: Symfony and Laravel on public release cycles, static analysis, modern application servers and now AI building blocks. What makes the difference is no longer the language itself, but the version you run, the tooling and the team’s discipline.

In this article, I review where PHP stands in September 2026 and the choices that matter when you build or take over a business application.

Where PHP stands in 2026

PHP remains the most widely used server-side language on the web: according to W3Techs, it powers close to 70% of websites whose server-side language is known (September 2026). In companies, its presence comes from the large number of existing applications, mature frameworks and a broad pool of developers.

The release schedule is public and regular: one minor version every year, in November. Here is the status of each branch as of September 30, 2026, according to php.net:

PHP 8.1 and all earlier versions have received no fixes at all since December 31, 2025. PHP 8.6 is in the release candidate phase, with general availability planned for November 19, 2026.

In practice, an application still running PHP 7.x or 8.0/8.1 runs on a version with no security fixes. That is the first thing we check during a technical audit.

What PHP 8.4 and 8.5 change day to day

PHP 8.4 (November 2024) brought property hooks (read or write logic attached to a property), asymmetric visibility (public private(set)), lazy objects, new array functions (array_find(), array_any(), array_all()) and an HTML5-compliant DOM API.

PHP 8.5 (November 2025) adds the pipe operator |>, a URI extension that parses addresses according to RFC 3986 and the WHATWG URL standard, clone() with property updates, the #[\NoDiscard] attribute and the array_first() / array_last() functions.

An example combining both versions:

<?php

declare(strict_types=1);

final class Customer
{
    // PHP 8.4: public read, write restricted to the class
    public private(set) string $status = 'prospect';

    // PHP 8.4: property hook, the value is normalized on write
    public string $email {
        set(string $value) {
            $this->email = strtolower(trim($value));
        }
    }

    public function activate(): void
    {
        $this->status = 'active';
    }
}

// PHP 8.5: pipe operator
$slug = '  Customer Invoice 2026  '
    |> trim(...)
    |> strtolower(...)
    |> (fn (string $s): string => preg_replace('/[^a-z0-9]+/', '-', $s));

For a business application, the benefit is concrete: less plumbing code (getters, setters), integrity rules carried by the model itself, and code that is easier to read for whoever takes it over.

Frameworks: Symfony and Laravel on clear cycles

Symfony ships a new version every six months and an LTS version every two years. In September 2026:

• Symfony 7.4 is the LTS version (released November 2025, PHP 8.2 minimum), with bug fixes until November 2028 and security fixes until November 2029;
• Symfony 8.1 is the current stable version (May 2026, PHP 8.4 minimum); Symfony 8.0 has been unmaintained since July 2026;
• Symfony 8.2 is planned for November 2026.

To choose between the LTS and the 8.x branch, see our article Symfony 7.4 or 8.0: how to choose.

Laravel 13 was released in March 2026 and requires PHP 8.3 or later. For data access, the reference ORMs remain Doctrine for Symfony and Eloquent for Laravel.

We use PHP and Symfony in production, for example on an e-learning platform built for a client.

Runtime: PHP-FPM, FrankenPHP and worker mode

The classic model (Nginx + PHP-FPM, one request = one application boot) remains reliable and fully supported. It now has a serious alternative: FrankenPHP, an application server written in Go and built on Caddy. Since May 2025, it has been officially supported by the PHP Foundation and its code is hosted in PHP’s GitHub organization.

Its worker mode keeps the application in memory between requests, which removes the boot time from each call. It also handles HTTPS automatically, HTTP/2 and HTTP/3. Laravel Octane and the Symfony Runtime can use it.

Worker mode requires care: no global state leaking from one request to the next, database connections properly reset, load tests before going live. It is not a setting to switch on “just to see” on a legacy application.

One last tooling change: PIE (PHP Installer for Extensions), released as 1.0 in June 2025, replaces PECL, now deprecated, for installing extensions.

Quality: static analysis, automated migrations, dependencies

Code quality in a PHP codebase in 2026 relies on a few tools that have become standard:

• PHPStan (or Psalm) for static analysis, at a level you raise gradually;
• Rector to automate PHP and framework upgrades;
• PHP-CS-Fixer for coding style;
• PHPUnit or Pest for tests;
• composer audit to flag dependencies affected by a known vulnerability.

A minimal Rector configuration to prepare an upgrade to PHP 8.4:

<?php
// rector.php

use Rector\Config\RectorConfig;

return RectorConfig::configure()
    ->withPaths([__DIR__ . '/src', __DIR__ . '/tests'])
    ->withPhpSets(php84: true);

And the commands we run in continuous integration:

composer audit
vendor/bin/phpstan analyse src --level=6
vendor/bin/rector process --dry-run
vendor/bin/phpunit

On a legacy application, we start with a low PHPStan level and a baseline (the list of existing errors), then raise the level with each iteration. Rector runs in --dry-run first: every transformation is reviewed before it is merged.

PHP and AI: an ecosystem that has taken shape

Not long ago, the usual advice was to switch to Python as soon as a project involved AI. To integrate an assistant, a document search engine or an agent into an existing business application, that is no longer necessary:

• Symfony AI provides components to call the main model providers, build agents with tools and manage vector stores. The project is at version 0.x (v0.14 in September 2026) and is working toward 1.0;
• the official PHP SDK for MCP, announced in September 2025 by the PHP Foundation, Anthropic’s MCP team and Symfony, lets a PHP application expose its functions to AI assistants through the MCP protocol;
• Laravel 13 ships its own AI SDK.

We walked through a project of this kind in Building an AI agent in PHP / Symfony and presented the components in Symfony AI. Python keeps its place for model training and data science; to add AI features to your product, your existing PHP stack is often the best starting point.

Modernizing an existing PHP application

Most PHP projects we take on don’t start from scratch. Our usual approach:

1. Assess the current state: PHP and framework versions, abandoned dependencies, test coverage, areas with no owner, performance.
2. Secure before changing: regression tests on critical flows, continuous integration, separate environments.
3. Migrate step by step: one PHP version, then one framework version at a time, with Rector and static analysis, released to production at each step.
4. Split only what justifies it: extract a module into a separate service when its load, life cycle or team requires it, not on principle.
5. Document as you go: architecture decisions, operating procedures, known debt.

That is what our Scope and modernize offer covers.

What we recommend

For a PHP business application, in September 2026:

• target PHP 8.4 or 8.5 and already plan the next upgrade;
• choose a maintained framework, and its LTS version if you need stability;
• put PHPStan, Rector, tests and composer audit into continuous integration from day one;
• only adopt worker mode after load testing;
• look at Symfony AI and MCP before creating a separate Python service for an AI feature.

At Etixio, every project is delivered by a team of engineers and a tech lead who is accountable for architecture and quality: systematic code review, automated tests, continuous integration, secrets management, separate environments, living documentation. Your code, your repositories and your access stay yours. Our teams work in your environment, with your rules.

Do you have a PHP application to evolve, modernize or build? Tell us about your project: we will start by looking at what you already have, together.

FAQ