Legacy & Modernization.

There is no official php2shell release for PHP 7.4, 8.0 and 8.1. Which packages, hosts and backports still close the flaw, and how to check that they do.

Read the article

Three days after the PHP patch: how many attacks there were, what is actually evidenced, the new flaw CVE-2026-115560 and who has shipped fixed packages.

Read the article

Exploitation attempts since 21 October. Officially fixed only in 8.2.35, 8.3.36, 8.4.27 and 8.5.12, everything below is open. 7.4 to 8.1 get backports only.

Read the article

Not a single security fix after 2026. If you are not on 8.2.35, you are already open to php2shell today. What to do now, with a plan before New Year.

Read the article

The switch is an afternoon, the data is the project: cut by ownership, shadow runs, switching in steps, and the five places where it tears.

Read the article

Four of the ten areas are a question of construction for a grown system, not of intent. The findings, the evidence, and the order that is worth the money.

Read the article

An archive is not software. What belongs on the list, in which order to ask for it, what to do on day one afterwards, and what helps when it stalls.

Read the article

Five sentences that ran through forty-four articles, two assessments that shifted, and four entry points depending on your situation.

Read the article

One rule set, one directory, one pull request: why the first attempt fails, which sets are mechanics and which are opinion, and how to review four hundred files.

Read the article

A handover is a state, not an appointment. The one test that says anything, the access inventory before it, and a deadline instead of an open door.

Read the article

The price is not driven by the amount of code but by five quantities you can establish in a week. Plus the items missing from every quote.

Read the article

Measure instead of guessing, set the waiting period by the rhythm of the thing, and know what goes with it. Half-deleted is worse than not deleted.

Read the article

What carries an expiry date, how to build the list in a day, why end of life minus lead time is the only number that counts, and the sentence that gets the budget.

Read the article

Not the dump but the shaped slice: pick an anchor, find the silent references, mask deterministically, and close the outbound paths in the environment.

Read the article

A shape that fits a quarter: six blocks, a result after each, a decision at the end, and the place where every plan tears.

Read the article

From SQL built out of strings to md5 passwords: the ten holes I find in almost every legacy PHP system, each with the command that tracks it down.

Read the article

Eight thousand messages become zero in a day: the baseline, what actually gets found at which level, and where further levels deliver nothing.

Read the article

Why the team often changes nothing after the project, four testable criteria for handover readiness, and the role split that shifts over time.

Read the article

Not modernizing does not mean doing nothing. Five things that keep running, three that stop, and the two facts without which it is neglect.

Read the article

The cost driver is not the data, it is the plugins. Three lists instead of one, four categories with four answers, and the order that pays off.

Read the article

The five phases of a data migration on a running system, the code for the trickiest one, and the four places where it tears in practice.

Read the article

Knowledge does not pile up because somebody hoards it but because the system forces it. Five properties, three useless measures, and what works instead.

Read the article

Why the tools from a Symfony upgrade do not bite here, and four places where Laravel upgrades have pitfalls of their own.

Read the article

No lock file, vendor in the repository, patched packages: how to reconstruct the dependency tree of an old PHP project before raising it.

Read the article

An implementation that stands up in a day: table, switch class, stable assignment. Where the switch sits, how it fits the database, and how it disappears again.

Read the article

Four kinds of cost you can put a number on, lead time as a measurement instead of an estimate, a risk table with expected values, and the one slide.

Read the article

Turning twelve thousand messages into an order of work: three kinds of deprecation, the bottom-up route, and the rebuilds that never announce themselves.

Read the article

The schema outlives every modernization of the code. The four legacy traits that are almost always there, what to measure first, and in what order to change.

Read the article

How to pin down the behaviour of a legacy system before you change it: characterization tests, golden master, seams, and when to stop.

Read the article

How I assess a legacy system in five days before somebody buys or inherits it: the order of work, the commands, and what ends up in the report.

Read the article

When the developer of a running system is gone, the first week decides the cost. What to secure before touching the code, in the right order.

Read the article

Five major versions in one jump. Loud errors are cheap. The dangerous break is silent, and your customer finds it first. What breaks, how I run it, what it costs.

Read the article

No security fix for almost ten years, and it still carries your revenue. Why zf1-future buys you time but not support, and the three honest ways out.

Read the article

How I add new high-performance Go services to existing PHP systems without rebuilding everything. Strangler fig in practice instead of a big-bang rewrite.

Read the article

Rewrites fail, and so does standing still. Why the complete rebuild almost never works and how incremental modernization delivers measurable results.

Read the article

A search migration from Sphinx to Manticore about latency, relevance and operational discipline. From 5 seconds to under 100 ms in practice.

Read the article

Technical debt is not a developer problem. It is a business risk, and it grows quietly until it becomes visible exactly when there is no room for it.

Read the article