Yii 2 end of life: what 23 November 2026 means for your application

If your business relies on a web application built with Yii 2, the team that maintains Yii has set a date you'll want to know about. From 23 November 2026, Yii 2 will only receive security fixes, and from November 2027 it won't receive any fixes at all. Applications on an older version of Yii 2 reach that point sooner, this November.

The short version: nothing is going to break on the day. Your application will keep running exactly as it does now. What changes is that the software underneath it is on a countdown, and once it's out of support, any new security holes found in it stay open. If it's on a recent version of Yii 2 you have about a year to plan what comes next, which is enough time to do it properly rather than in a hurry. I was having exactly that conversation with a client just the other week, about a Yii 2 platform they've earmarked for replacement through 2027.

What happens when Yii 2 reaches end of life?

If someone finds a new security hole in Yii 2 after its end of life, nobody will be fixing it. The world around it keeps moving too, with new versions of PHP, the language Yii is written in, and hosting platforms retiring the older ones. And if your business fills in security questionnaires for customers or insurers, or holds Cyber Essentials, you'll be asked whether the software you run is still supported.

To be fair to Yii, these dates have moved before. The end of life for Yii 1 was pushed back four times, from the start of 2020 to the end of 2026. In my experience Yii has been a very dependable framework for a long time, even with a much smaller community than Laravel's, and its maintainers have kept pace with each new version of PHP and each security advisory. But nothing lasts forever, and I wouldn't plan around another extension.

What should you check?

You don't need to be technical to get a clear picture, just a short conversation with whoever looks after the application. These are the questions I'd ask:

• Which version of Yii 2 is it running? Your developer can find this in a couple of minutes. If it's 2.0.49 or earlier, its security fixes stop this November, and bringing it up to date should be the first job whatever you decide next.
• Which version of PHP does it run on, and is the hosting still supported? The language and the servers underneath have deadlines of their own, like the Elastic Beanstalk PHP 8.2 retirement, and it usually makes sense to deal with them together.
• Who looks after it today? If the answer is a developer who has since moved on, or nobody in particular, that's worth sorting out early.
• How important is it, and for how long? A system the business runs on every day for the next five years needs a different plan from one that's being wound down.
• What's on the wish list? The features people keep asking for and the bugs everyone has learnt to work around are part of the decision too.

What are your options after Yii 2?

With that client, the conversation quickly came down to one question: where do you go from Yii 2? There isn't a single right answer, but in most cases it's one of these:

• Keep it on Yii 2 for now. Bring it up to the latest version and use the time until November 2027 to plan properly. It won't solve anything on its own, but it buys time, and time is often what's needed.
• Move to Yii3. It's the same family, but it isn't a straightforward upgrade. The Yii team's own guide treats it as building a new application informed by the old one, so it's closer to a rebuild.
• Move to a different framework. Laravel is the obvious one in the PHP world, with a much bigger community, and since Yii3 is effectively a rebuild anyway, the effort can be comparable.
• Rethink how it's built. Rather than moving everything like for like, break parts of it out into cloud-native services, such as serverless functions on AWS, where that makes the application cheaper or easier to run.

Whichever route you take, replacing the framework underneath an application is a significant piece of work, and that makes it the right moment to deal with the things that have been waiting. The features that have been on the wish list for years and the bugs that never quite got fixed can be built into the plan rather than squeezed in afterwards, so the business ends up with something it notices as well as newer foundations.

Need help with a Yii 2 application?

The questions above are a good first step, and in my experience the answers usually make the right option fairly clear. I've worked with Yii since 2010 and still look after Yii 2 applications today, so if you'd like a hand working out where yours stands and what should come next, get in touch. The Yii development page has the end-of-life dates for every version of Yii.

Also in this series: the RDS MySQL 8.0 end of standard support email, the Lambda Node.js 20 end-of-life email and the Elastic Beanstalk PHP 8.2 platform retirement email.