Short answer: the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) showed once again how much risk old PHP versions carry. For systems on PHP 7.x, 8.0 and 8.1 the PHP project published no official fix; their security now depends on the hosting provider’s patch. 360 Soft moves your legacy PHP applications to 8.3 or 8.4 in a test environment, fixes compatibility issues and takes them live without downtime.
Why upgrade now?
- Unsupported versions get no patches: PHP 8.1 and older are out of active support. The official PHP2Shell releases came out only for the 8.2, 8.3, 8.4 and 8.5 branches.
- 8.2 is about to end too: PHP 8.2 security support ends on 31 December 2026. Moving to 8.2 today means repeating the work a few months later.
- Audit and compliance: in enterprise audits, penetration tests, ISO 27001 reviews and data protection assessments under GDPR or KVKK, the use of unsupported software is reported as a finding.
- Performance: PHP 8.3 and 8.4 run noticeably faster than 7.x, which can lower server costs.
Upgrade process
- Inventory and pre-analysis: the PHP version, framework, plugins and libraries of the application are listed. Static analysis tools (PHPCompatibility, Rector) report incompatible lines of code.
- Test environment: an exact copy of the live system is brought up on the target PHP version. The live site is not touched.
- Fixes: removed functions, type errors, old plugins and libraries are updated. The framework version is upgraded too if needed.
- Testing: critical business flows (login, payment, forms, reports, integrations) are tested end to end. Logs and performance are compared.
- Go-live: the switch happens in a low-traffic window, with a backup taken and a rollback plan ready. The system is monitored for 7 days after go-live.
Platforms we work on
| Platform | Typical work | Estimated duration |
|---|---|---|
| WordPress / WooCommerce | Theme and plugin compatibility, replacing abandoned plugins, move to PHP 8.3/8.4 | 1 to 3 working days |
| Laravel | From Laravel 5.x to 9.x up to a current release, package updates, tests | 1 to 4 weeks |
| CodeIgniter, Yii, Symfony | Framework version upgrade or move to a modern structure | 2 to 6 weeks |
| Magento, OpenCart, PrestaShop | Platform and module updates, payment integration tests | 1 to 4 weeks |
| Custom PHP (no framework) | Code analysis, rewrite of critical modules or platform change | Depends on analysis |
If the code is very old or the cost of upgrading approaches that of a rewrite, we say so clearly in the pre-analysis. In that case we present PHP to.NET migration and a rebuild on current Laravel side by side so you can compare.
Common compatibility issues we fix
- Removed functions and extensions (for example the old mysql_* functions, each(), create_function())
- Stricter type handling: passing null to non-nullable internal parameters, string-to-number comparisons
- Dynamic properties, deprecated in 8.2 and a source of warnings in many legacy classes
- Old Composer packages and plugins that pin outdated PHP versions
- Changes in error handling that turn former warnings into exceptions
PHP2Shell: protection during the upgrade
Your system must not stay exposed while the upgrade is being planned. Before upgrading we apply temporary mitigations (the session.upload_progress setting, WAF rules, external access restrictions) and confirm that the vendor patch is installed. For details see our PHP vulnerability remediation page. If you run many PHP applications across brands or countries, an enterprise PHP security audit first builds the full inventory.
Engagement models
| Model | Scope | Best fit |
|---|---|---|
| Single upgrade project | One application moved to 8.3 or 8.4 with tests and go-live | A WordPress, Laravel or shop system on an old version |
| Upgrade programme | Several applications upgraded in waves by priority | Agencies, groups and companies with many sites |
| Upgrade plus maintenance | Upgrade followed by monthly maintenance, security updates and monitoring | Teams without in-house PHP capacity |
| Dedicated PHP developers | Developers join your team remotely, on-site or hybrid | Long-running modernisation roadmaps |
If you prefer to extend your own team, you can also hire Laravel and PHP developers from us. Teams can start with one developer and grow as needed; longer engagements typically start within 1 to 2 weeks, and we run a replacement process if a team member needs to be changed.
KPIs and acceptance criteria
| KPI | Target meaning |
|---|---|
| Critical flows passing | All agreed business flows pass on the target version before go-live |
| Error log volume | No new errors or deprecations in the 7-day monitoring window compared with the baseline |
| Response time | Same or better response times after the upgrade |
| Rollback readiness | Tested backup and rollback plan before the switch |
What drives the effort (no fixed prices)
- Source PHP version and framework version
- Number of plugins, modules and third-party packages
- Amount of custom code and test coverage
- Number of integrations (payment, ERP, CRM, APIs)
- Hosting setup: shared hosting, VPS, containers, cloud
- Required go-live window and monitoring period
Contract and data protection
We work under a B2B service agreement; the code changes we make are assigned to you, and an NDA is signed before the first call if needed. When test environments contain personal data, we sign a GDPR data processing agreement with Standard Contractual Clauses (UK IDTA for UK data) and process data in Turkey in line with KVKK. Wherever possible we work with anonymised test data.
Frequently asked questions
Will my site break if I upgrade PHP?
If the version is switched directly on the live server, old plugins, removed functions and type changes can cause errors. We do the upgrade first in an exact copy in a test environment, fix the errors and go live only after the tests pass. A rollback plan is always ready.
I use PHP 8.1. Is it urgent?
Yes. The PHP project did not publish an official release for PHP 8.1 against the PHP2Shell flaws, so protection depends on your vendor’s patch. Because 8.1 is out of active support, the same will happen with the next vulnerability. The target should be 8.3 or 8.4.
Which version should I move to?
For most business applications PHP 8.3 is the balanced choice, with a long support window and broad library compatibility. For new development we recommend 8.4. PHP 8.2 should not be chosen as a target because its support ends on 31 December 2026.
I have Laravel, CodeIgniter or old custom code. Can it be upgraded?
Yes. For Laravel 5.x and 6.x, CodeIgniter 3 and older custom PHP projects we first map the dependencies and then update the framework and packages step by step. If the code is very old and business-critical, a rewrite or platform change may be more economical, and we show this clearly in the analysis.
How long does it take?
A single WordPress site is usually tested and upgraded within 1 working day. Mid-sized Laravel or custom applications take 1 to 3 weeks, and multi-module enterprise systems are planned after a scope analysis.
Do you need access to our live server?
For the analysis and test environment we need the code and a copy of the database, ideally anonymised. Access to the live server is needed only for go-live and is time-limited and logged.
Can you upgrade without downtime?
Yes, in most cases. The switch is done in your low-traffic window with a backup and rollback plan; for larger systems we use blue-green or parallel deployments where the hosting allows it.
Do you also maintain the system afterwards?
Yes. After the upgrade we can take over monthly maintenance, security updates and monitoring, or hand over to your team with documentation.
Do you work with teams outside Turkey?
Yes. We work remotely with clients in the EU, the UK, the US and the Middle East, in English, with time-zone overlap and on-site visits when needed.
Request a version upgrade
Send us your site address, the platform you use (WordPress, Laravel, custom PHP, Magento and so on) and your hosting type (shared hosting, VPS, cloud or your own server). Call +90 850 335 10 87, message us on WhatsApp, write to info@360-soft.com or use the contact page. Requests reach the team outside office hours as well. See all outsourcing services.
Sources: PHP security announcement and list of supported versions, technical notes from Tenable and InMotion Hosting. Updated: 22 October 2026.
