26 November, and what changes is not the code — it is that no security patch is coming for whatever is found in December.
the supported set, from 27 November 2023:
8.1 security fixes until 2025-12
8.2 active support until 2024-12
8.3 active support until 2025-12
and what "end of life" does not mean:
the code stops working no
the distribution stops shipping it depends, and
check yours
a CVE will definitely appear also no — but the
decision has to assume one might
The argument that gets made every time is that nothing has actually broken, which is true and is not the point: the risk is not that a version stops working, it is that a vulnerability is disclosed and there is no patch. Distribution backports muddy this — a long-term-support distribution may patch a version upstream has retired — so the answer depends on where PHP came from, and that is worth establishing before the deadline rather than during an incident.