Short answer: the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) led many organisations to re-evaluate their legacy PHP systems. We rebuild unpatchable, undocumented or hard-to-maintain PHP applications on ASP.NET Core, migrate the data without loss and preserve the URL structure for a seamless switch. If you have a current, healthy PHP system, we recommend a PHP version upgrade first; the right decision is made together with a free pre-analysis.
When is moving to.NET the right decision?
- The application runs on PHP 5.x or 7.x, without a framework or on a very old one, and upgrading would take almost as much work as a rewrite.
- Your organisation runs on Azure, Active Directory / Entra ID, SQL Server and Microsoft 365 and wants to consolidate on one technology stack.
- You operate in a tightly regulated sector such as banking, insurance, healthcare or the public sector and need long-term support (LTS) and a type-safe platform.
- Your in-house team knows C#, PHP knowledge has faded and maintenance costs rise every year.
When you should not migrate
Moving a current WordPress, WooCommerce or Laravel site to another platform just because of PHP2Shell is not necessary: patching and a version upgrade close the vulnerability. For these systems, staying on PHP is often the better choice in terms of content management, plugin ecosystem and cost. In the pre-analysis we present this comparison with duration and budget estimates.
Migration steps
- Discovery: modules, business rules, integrations, user roles and the database schema are mapped. Undocumented business rules are written down through code review.
- Architecture: ASP.NET Core (MVC / Razor Pages or Web API plus a modern front end), Entity Framework Core, identity management, logging and monitoring are designed.
- Module-by-module development: we start with the most critical flow. Old and new systems can run side by side for a period (strangler pattern).
- Data migration: trial migrations, record-count and amount reconciliations, and secure re-implementation of password storage.
- SEO and URL preservation: the URL structure is kept or a 301 redirect map is prepared; Search Console is monitored.
- Go-live and support: switch with a rollback plan, followed by a maintenance and support agreement.
Comparison of options
| Option | When it fits | Duration | Risk |
|---|---|---|---|
| PHP patch plus version upgrade | Current WordPress / Laravel, healthy code | Days to weeks | Low |
| Rewrite on current Laravel | Legacy PHP, team knows PHP | Weeks to months | Medium |
| Rewrite on ASP.NET Core | Microsoft ecosystem, need for enterprise LTS | Weeks to months | Medium |
| Node.js / modern JS stack | Real-time, API-centric products | Weeks to months | Medium |
Technology mapping
| In PHP | In.NET |
|---|---|
| Laravel / custom routing | ASP.NET Core routing, MVC or Minimal APIs |
| Eloquent / PDO | Entity Framework Core or Dapper |
| Sessions and custom login | ASP.NET Core Identity, Entra ID, OpenID Connect |
| Cron jobs | Hosted services, Hangfire or Azure Functions |
| Blade / PHP templates | Razor Pages, Blazor or a separate React / Angular front end |
| Composer packages | NuGet packages |
Illustrative scenario: a legacy dealer portal
Illustrative scenario, not a client reference. A distributor runs a dealer ordering portal written in framework-less PHP 7.2 more than ten years ago. The original developers have left, there is no documentation, and the hosting provider can only offer a vendor patch for PHP2Shell. The company already uses Entra ID and SQL Server. In this kind of situation we would first apply a temporary mitigation to the old portal, document the ordering and pricing rules from the code, and then rebuild the portal on ASP.NET Core module by module: login and dealer accounts first, then catalogue and ordering, then reports. The MySQL data would be reconciled in trial runs before the final switch, and the old URLs redirected with 301s.
Security built into the new platform
A migration is also the moment to remove the weaknesses that made the old system hard to protect. On ASP.NET Core we use parameterised data access through Entity Framework Core, framework-level protection against cross-site request forgery, modern password hashing, centralised logging and dependency scanning in the CI/CD pipeline..NET LTS releases receive regular security updates from Microsoft on a published schedule, so patching becomes a routine maintenance task rather than an emergency.
Team and engagement models
- Fixed-scope migration project: analysis, development, data migration and go-live delivered by our team.
- Dedicated team:.NET developers, a QA engineer and a tech lead working with your product owner; we scale from 1 to 200+ people.
- Staff augmentation: .NET developers or PHP developers joining your own team remotely, on-site or hybrid.
Teams typically start within 1 to 2 weeks, and if a team member needs to be replaced we run a structured replacement process with handover.
KPIs during migration
| KPI | What it shows |
|---|---|
| Modules migrated | Progress against the agreed module plan |
| Data reconciliation | Record counts and totals match between old and new system |
| Defect trend | Open defects by severity before each release |
| SEO continuity | Indexed URLs, redirect errors and organic traffic after go-live |
What drives cost and duration (no fixed prices)
- Number of modules and business rules
- Integrations with ERP, CRM, payment or government systems
- Data volume and data quality
- Need to run old and new systems in parallel
- Front-end scope: same design or redesign
- Hosting target: Azure, other cloud or on-premise
Contract, IP and data protection
Source code, design and all accounts belong to you, and IP assignment is part of the B2B service agreement. The NDA is signed before the first call. Where personal data is migrated we sign a GDPR data processing agreement with Standard Contractual Clauses (UK IDTA for UK data), and our processing in Turkey follows KVKK. For an acute security issue see PHP vulnerability remediation, and for a group-wide inventory see enterprise PHP security audit.
Frequently asked questions
Does it make sense to convert my PHP site to.NET?
Not for every PHP system. For a current Laravel or WordPress site, a version upgrade is usually faster and more economical. If you have an old, undocumented, unpatchable and business-critical PHP application, if your organisation works in the Microsoft ecosystem (Azure, Active Directory, SQL Server) or if you want long-term enterprise support, moving to.NET is a strong option.
What happens to my database?
A MySQL or MariaDB database can be kept, because Entity Framework Core works with these databases. A move to SQL Server or PostgreSQL can also be planned. Data is migrated with reconciliation counts and trial runs.
Will the site go offline during the migration?
No. The new system is developed in parallel, verified in a test environment and rolled out module by module. The URL structure is preserved for users and 301 redirects are set where needed, so SEO traffic is not lost.
How long does it take and what does it cost?
Duration and cost depend on the number of modules, integrations and data volume. A corporate website moves in a few weeks, while a multi-module portal or ERP-like application takes a few months. After the free pre-analysis we provide duration and price item by item.
What about the PHP2Shell risk while we wait for the migration?
When the migration project starts we apply a patch or temporary mitigation to the old PHP system, and it stays protected until the new system is ready.
Can our own developers take over the new system?
Yes. We document the architecture, hand over the repositories and pipelines and can run joint sprints so your team is ready to maintain the code.
Do you work with clients outside Turkey?
Yes. We work in English with clients in the EU, the UK, the US and the Middle East, remotely with time-zone overlap and on-site when needed.
Who owns the code?
You do. The source code, design files, documentation and all cloud and repository accounts are yours.
Request a migration analysis
Send us your site address, the platform (WordPress, Laravel, custom PHP, Magento and so on) and your hosting type. Call +90 850 335 10 87, use WhatsApp, email info@360-soft.com or visit our contact page. More: outsourcing services.
