Laravel 12’s bug-fix window closed on 13 August 2026. Security patches continue until February 2027, but new framework bugs are now your problem. The practical question for Philippine teams is not “is Laravel 13 shiny?” — it is upgrade now, or wait with a written plan.
This is the decision we walk through with clients who already have a production Laravel app — not a greenfield tutorial.
What the calendar actually means
Laravel’s current policy is uniform: 18 months of bug fixes, two years of security. There is no LTS escape hatch.
| Version | Released | Bug fixes | Security until | Status in September 2026 |
|---|---|---|---|---|
| Laravel 11 | Mar 2024 | Ended Sep 2025 | Ended Mar 2026 | Uncovered — move |
| Laravel 12 | Feb 2025 | Ended 13 Aug 2026 | Feb 2027 | Security only |
| Laravel 13 | 17 Mar 2026 | Through Q3 2027 | Mar 2028 | Current major |
Laravel 13 needs PHP 8.3 or newer. If you are still on PHP 8.2 — common on older shared and some VPS images — that is the first job, before you touch composer.json.
New work should start on 13 unless a package or host blocks you. Laravel 11 or older is not “a little behind.” It is out of security support.
Upgrade now if these are true
Move this quarter when:
- You are already on PHP 8.3+ in staging and production
- Composer dependencies have Laravel 13 releases (or clear forks)
- You have a test suite that exercises checkout, auth, queues, and the two or three flows that make money
- You want the longer security window and first-party AI primitives without rushing them into production on day one
Official notes describe Laravel 13 as a small application-code upgrade for typical apps — CSRF middleware renamed (VerifyCsrfToken → PreventRequestForgery), stricter cache deserialization defaults, prefix/cookie naming to pin if you relied on framework defaults. Most of the pain is PHP version and stale packages, not rewriting controllers.
That matches how we treat framework work generally: change the runtime in isolation, then the framework, then features. Same discipline as how we build scalable web applications.
Wait (briefly) if these are true
Waiting is legitimate when it is time-boxed, not vague:
- Production is still on PHP 8.2 and the host change is a separate ops project
- A critical package has no Laravel 13 release and no maintained alternative
- You have no automated tests around payments, bookings, or inventory — upgrade-then-hope is how you get a quiet production incident
- You are mid-feature freeze for a launch week
Laravel 12 still gets security fixes until 24 February 2027. That is a runway, not a destination. Write the upgrade date. Do not treat “we will get to it” as a plan.
If you are on 11 or older, waiting is not a strategy. Budget the jump.
A sane upgrade sequence
- Inventory — PHP version, first-party packages, paid modules, custom middleware that names
VerifyCsrfToken - PHP first — 8.3+ on local, CI, and production, proven independently
- Composer —
laravel/framework ^13.0and matching first-party constraints on a branch - Config review — cache
serializable_classes, explicitCACHE_PREFIX/ session cookie if you need old keys - Tests + staging — money paths, webhooks, queues, Filament/Nova/admin if you have them
- Production — deploy, flush cache, watch logs for a week
Skip “upgrade and add AI in the same release.” The Laravel AI SDK is a product conversation. This article is a maintenance conversation.
What we will not pretend
- Upgrading does not magically speed up a plugin-shaped WordPress leftover. If you are still deciding the stack, read Laravel vs WordPress for business websites first.
- A weekend composer bump without staging is not “agile.” It is unpaid incident response.
- You do not need to adopt every Laravel 13 headline feature to justify the move. Supported PHP + supported framework is enough reason.
Straight next step
If you run a Philippine business system on Laravel 12 (or older) and want a grounded upgrade path — what blocks you, what can wait, what we would do in which order — send us the stack notes. We will be direct about “this week,” “this quarter,” and “do not touch until PHP is sorted.”
