Critical Security Alert: Node.js 18 and PHP 7.4 Reach End-of-Life

PHP 7.4 is Dead. Node.js 18 is Dead. Is Your Stack Running on Ghosts?

Node.js 18 and PHP 7.4 have officially reached end-of-life, yet they remain widely deployed in production environments worldwide. Node.js 18 ceased receiving security updates on April 30, 2025, over a year ago.

Why This Matters

The technical reality is that CVE-based vulnerability scanners often fail to flag EOL runtimes because upstream projects stop issuing official advisories. This creates a “CVE blind spot” where a green checkmark from a scanner does not indicate safety, but rather a lack of active monitoring by the software maintainers. Organizations running these versions are exposed to structural risks where new vulnerabilities are discovered but never formally catalogued against the dead versions.

Key Insights

• Node.js 18 reached EOL on April 30, 2025, and many scanners now return zero results for it despite existing attack surfaces.
• PHP 7.4 has been unsupported since December 28, 2022, yet remains a top search query due to its deep embedding in legacy CMS architectures.
• The CVE model breaks for EOL software because the vendor chain for triaging and disclosing new vulnerabilities is severed.
• PHP 8.2 is approaching its EOL deadline on December 31, 2026, requiring immediate migration planning to PHP 8.3 or 8.4.
• Commercial extended support services like HeroDevs and TuxCare provide a bridge for compliance-sensitive environments unable to migrate immediately.

Practical Applications

• Use Case: Production environments on Node.js 18 should migrate to Node.js 22 (LTS) to ensure security patches through April 2027.
• Pitfall: Relying on automated scanners for EOL software leads to false negatives because vulnerabilities are no longer formally catalogued against dead versions.
• Use Case: PHP 7.4 users on legacy systems can utilize TuxCare for extended lifecycle support to mitigate risks during long-term migration projects.

References:

• https://dev.to/endoflifeai/php-74-is-dead-nodejs-18-is-dead-is-your-stack-running-on-ghosts-2ibl