Cryptman 2.0.0 shipped on 19 August 2026. As set out in SECURITY.md, 1.x now enters a twelve-month security-fix window and reaches end of support on 19 August 2027.
What this means
Until then, 1.x gets security fixes only — no features, no bug fixes.
After that date it gets nothing. It will keep working and your data stays readable. Nothing switches off, nothing expires, no release is withdrawn. It simply will not be patched again.
What to do
Everyone on 1.x, today: pass an explicit key. Constructed without one, 1.x falls back to php_uname() — a publicly guessable description of your host OS — and data encrypted that way is effectively unencrypted.
// vulnerable
$cryptman = new Davmixcool\Cryptman();
// fixed — works on 1.x today, no upgrade needed
$cryptman = new Davmixcool\Cryptman(['key' => $yourSecretKey]);
If you have data encrypted under the fallback, treat it as compromised and re-encrypt it. This is worth doing regardless of which version you end up on.
On PHP 8.2 or newer: upgrade to 2.x. It reads everything 1.x wrote, so your data keeps working, and it adds tamper detection that 1.x cannot provide. The upgrade guide lists the two things to check before deploying.
Not on PHP 8.2 and can't get there: stay on 1.x. Composer won't offer you 2.x, so nothing breaks. You have until August 2027, and the key fix above is the importantpart.
Worth saying plainly: PHP 8.1 itself stopped receiving security fixes in December 2025. If your runtime can't reach 8.2, that's a bigger exposure than this library, and it's the thing to plan around.
Questions
Reply here. If you hit something specific while upgrading, open an issue and reference this thread.
Cryptman 2.0.0 shipped on 19 August 2026. As set out in SECURITY.md, 1.x now enters a twelve-month security-fix window and reaches end of support on 19 August 2027.
What this means
Until then, 1.x gets security fixes only — no features, no bug fixes.
After that date it gets nothing. It will keep working and your data stays readable. Nothing switches off, nothing expires, no release is withdrawn. It simply will not be patched again.
What to do
Everyone on 1.x, today: pass an explicit
key. Constructed without one, 1.x falls back tophp_uname()— a publicly guessable description of your host OS — and data encrypted that way is effectively unencrypted.If you have data encrypted under the fallback, treat it as compromised and re-encrypt it. This is worth doing regardless of which version you end up on.
On PHP 8.2 or newer: upgrade to 2.x. It reads everything 1.x wrote, so your data keeps working, and it adds tamper detection that 1.x cannot provide. The upgrade guide lists the two things to check before deploying.
Not on PHP 8.2 and can't get there: stay on 1.x. Composer won't offer you 2.x, so nothing breaks. You have until August 2027, and the
keyfix above is the importantpart.Worth saying plainly: PHP 8.1 itself stopped receiving security fixes in December 2025. If your runtime can't reach 8.2, that's a bigger exposure than this library, and it's the thing to plan around.
Questions
Reply here. If you hit something specific while upgrading, open an issue and reference this thread.