All services

PHP upgrade & migration

From old PHP to PHP 8. While the system keeps running, with a way back at every step.

If your system runs on PHP 5.6, 7 or an early 8, it runs without security updates. The upgrade still gets postponed, because nobody can say what it will set off: dependencies without a successor, code without tests, and the people who wrote it are gone. I turn that into a project with a sequence, a way back and a date, while the system keeps running.

PHP 5.6 → 8.4Rector & PHPStanNo downtimeFrom 1,250 €
What you get
  • A compatibility assessment: what breaks, where, at what effort
  • An order in steps that can each go live on their own
  • A test net around the places that get touched
  • The upgrade while everything keeps running, with a way back at every step
  • Dependencies on maintained versions, abandoned ones replaced
  • Handover to your team, in writing and in conversation
Scope & working together

The entry point is a fixed-price assessment, implementation is quoted by scope. Also for systems without documentation and without the people who built them.

Remote from Germany. Straight with me, no agency in between.

The starting point

The upgrade is not the problem.

The language changes from PHP 7 to 8 are manageable and well documented. What makes projects fail sits next to them: a library whose last commit is seven years old. A framework three major versions behind. An extension that never existed for PHP 8. And a database driver that quietly compares differently than it used to.

If your system comes from PHP 5, the situation is a different one, and I will say so plainly: the break is not between 7 and 8 there, it is between 5 and 7. The old database functions were removed outright, errors became exceptions, and constructs such as each() or create_function() are gone. Projects like that therefore run in two stages over an intermediate version rather than in one jump, each stage live on its own and each reversible on its own.

On top of that comes the situation most enquiries grow out of. The code runs, it earns money, and the people who wrote it are no longer around. There are no tests, no documentation and nobody who can say why one place rounds the way it does. An upgrade is then not a maintenance task but a bet that you have found everything.

That is exactly why the work does not start in the code but with an assessment: what breaks, what might break, and which of it touches money. Only after that can anyone say whether the project takes two weeks or three months.

Does any of this sound familiar?
  • The system runs on PHP 5.6, 7.4 or 8.1 and no longer receives security updates.
  • A supplier offered the upgrade and then stopped naming the effort.
  • The hosting provider is retiring the old PHP version and nobody knows what happens then.
  • There are no tests, so nobody knows whether everything still adds up after the upgrade.
  • Composer reports conflicts as soon as a single version is raised.
  • An audit or a customer requires a supported runtime.

Who this is for

For owners whose PHP application must keep running while its runtime expires.

For CTOs and technical leaders with a productive application on an old or unsupported PHP version. Security, hosting or library compatibility makes delay a growing risk.

01

The application is still needed.

It supports revenue or core processes and must remain maintainable for years.

02

A big bang is too risky.

Dependencies, test gaps and unknown effects require small steps with a clear way back.

03

Operations cannot stop.

The upgrade must coexist with delivery and leave the existing team able to continue.

What I do

What happens along the way

01

A compatibility assessment instead of a gut feeling

PHPStanRector (dry run)Composer why-not

Static analysis across the whole codebase, separated into genuine breaks, changed semantics and abandoned functions. Plus the dependencies: which packages exist for the target version, which are abandoned, which need a replacement. The result is a list with location, severity and estimated effort.

02

A safety net before the first change

PHPUnitCharacterization testsGolden master

Where no tests exist, characterization tests come first: they record what the system does today, regardless of whether it is right. The net does not have to be complete, it has to cover the places that get touched and the paths that money hangs on.

03

Automated rewriting where it is safe

RectorPHP-CS-FixerSmall commits

Rector handles the mechanical part: type declarations, deprecated calls, changed signatures. A rule set per target version, in small runs, each one its own commit and reviewable on its own. Every run is produced as a preview first and read through, because the tool does not report where it was unsure: it changes whatever a rule matches and leaves everything else alone. What remains open after that goes on the manual list by hand.

04

Dependencies and framework

ComposerSymfonyLaravelReplacing abandoned packages

The larger part of the effort rarely sits in the language, it sits in Composer. Packages move to maintained versions, abandoned ones get replaced, and where a framework is several major versions behind, the jump is broken into steps of its own. A Symfony or Laravel upgrade does not come along for free.

05

Into production in stages

Staged rolloutCanaryA way back at every step

Not one cut-over date but a sequence of small changes, each one deployable on its own and reversible on its own. Where the architecture allows it, the new version runs for a share of the traffic first. Whatever shows up then shows up at one per cent, not at a hundred.

06

Afterwards: no new legacy system

CI checksDependabotMaintenance plan

At the end come the things that stop the same conversation happening again in three years: static analysis in the pipeline, a dependency check as a recurring run, and a note about when the version you chose now falls out of support.

Is your PHP still on a version without security updates?

Send me the key facts. You get an assessment of what the upgrade means for you before you commission anything.

How it runs

How this runs

Four steps, and after the first one you know what you are getting into. No step assumes that you commission the next one.

STEP 01

Key facts and access

PHP version, framework, rough size, test coverage, where it gets deployed. Read access to the repository is enough for the assessment; production access is only needed later.

STEP 02

Assessment

Static analysis and a dependency check, delivered as a list with locations, severity and effort, plus an order. That lets you decide, including against me.

STEP 03

Secure and rewrite

A test net at the places that get touched. After that the automated runs, then the manual work. Every step a commit, every commit traceable on its own.

STEP 04

Roll out and hand over

Into production in stages, with a way back. At the end checks in the pipeline and a handover, so your team carries on by itself from there.

Entry offer

PHP upgrade. From 1,250 €

Starting price for the assessment. Implementation is quoted by scope, at a fixed price, before it begins.

The entry point is an assessment, not an implementation: you find out what an upgrade means for you before you have to decide on it.

What you get

  • Static analysis across the whole codebase, against the target version
  • Dependency check: what exists, what is abandoned, what needs replacing
  • A list of the breaks with location, severity and estimated effort
  • An order in steps that can each go live on their own
  • An assessment of test coverage and the safety net needed
  • One hour discussing the results, recorded on request

What you do not get

  • No implementation of the upgrade, no refactoring, no new features
  • No framework migration, that is quoted separately
  • No review of the infrastructure, the AWS cost analysis covers that
  • No security review in the sense of a penetration test
  • Read access to the repository is enough, production access is not needed
  • Price excludes VAT
  • From around 200,000 lines or several applications the scope is agreed beforehand
  • The amount is credited if you commission the implementation afterwards
  • You are under no obligation. Some clients implement the assessment themselves, and that is a valid outcome

The outcome

What is different afterwards

Supported again

Security updates arrive again, and the question in the next audit is answered without anyone having to justify an exception.

Changeable instead of frozen

Current dependencies mean a new package can be installed without three others blocking it. That was the real standstill before.

A net that stays

The tests written for the upgrade belong to you afterwards. They protect the next change just as they protected this one.

Measured, not estimated

Whether and how much faster your application runs on PHP 8 depends on the application, not on the language. So the same paths get measured before and after, and the figure goes into the closing report.

Technologies I use

What I work with

Language
  • PHP 8.2
  • PHP 8.3
  • PHP 8.4
  • PHP 8.5
Frameworks
  • Symfony
  • Laravel
  • Laminas
  • Slim
Analysis
  • PHPStan
  • Psalm
  • Rector
  • PHP-CS-Fixer
Tests
  • PHPUnit
  • Pest
  • Xdebug
  • Characterization tests
Packages
  • Composer
  • Packagist
  • Composer Audit
  • Dependabot
Data
  • MySQL
  • MariaDB
  • PostgreSQL
  • Doctrine
  • PDO
Runtime
  • Docker
  • PHP-FPM
  • Nginx
  • OPcache
  • Valkey / Redis
Delivery
  • GitHub Actions
  • GitLab CI
  • AWS
  • Blue/green

Evidence

PHP and Zend Framework certified.

Most suppliers know the destination. With an old system, what decides the outcome is whether someone also knows the starting point: why a passage is written the way it is, and what replacing it sets off. Zend Technologies no longer exists under that name, and neither do the exams of the time. For the database side there is an Oracle certification on MySQL 5, because that is where the quieter traps sit: character sets, collations and a strict mode that starts refusing what used to pass.

Zertifikat: Tim Rutte, Zend Certified Engineer PHP 5.3, ausgestellt von Zend Technologies
Zend Certified Engineer – PHP 5.3
Zertifikat: Tim Rutte, Zend Certified Engineer Zend Framework, ausgestellt von Zend Technologies
Zend Certified Engineer – Zend Framework
Tim Rutte, Cloud & Software Architect

Who you are talking to

Directly with me as a freelancer. No agency in between.

I am Tim Rutte. More than 20 years in software development, most of it in PHP, from 5.x to today. You talk to the person who touches your code, from the first call to the handover.

  • 20+years in software development
  • 50+successful projects
  • 2003working remotely since then
More about me

Common questions

Common questions about the PHP upgrade

What does a PHP upgrade cost?

The assessment costs from 1,250 euros excluding VAT and tells you what the implementation costs. Without an analysis every number is a guess: two applications with the same line count can be a factor of ten apart, depending on whether the dependencies are maintained and whether tests exist. The implementation is quoted at a fixed price after the assessment, before it begins.

Which PHP versions still receive security updates?

As of August 2026: PHP 8.2 until 31 December 2026, PHP 8.3 until the end of 2027, PHP 8.4 until the end of 2028 and PHP 8.5 until the end of 2029. Everything up to and including 8.1 is unsupported, PHP 7.4 since the end of 2022. As a target I usually recommend 8.4: a version that has been out long enough for the libraries to have caught up, and that still has more than two years of support.

We are still on PHP 5.6. Is that too old?

No, that is a regular case. It is a different project from a jump off 7.4 though: the harder breaks sit between 5 and 7, the old database functions were removed outright, errors became exceptions. The route therefore runs over an intermediate version in two stages, each one live on its own and reversible on its own. I am a Zend Certified Engineer for PHP 5.3, so I know the starting world from more than the migration notes. What your case means is settled after the assessment, not before it.

We have no tests. Does this still work?

Yes, and that is the normal case. Before the first change a net of characterization tests goes in, recording what the system does today. It does not have to be complete: it covers the places that get touched and the paths that money hangs on. That net stays with you afterwards.

Does the system have to be taken offline for this?

No. The upgrade runs as a sequence of small changes, each one deployable on its own and reversible on its own. On the publishing platform from my case studies the modernization ran without a single day of downtime, even though language, search and platform all changed. What matters is keeping as little as possible in motion at once: there, the language switch, the new search and the platform move were three separate projects, each with its own way back.

What about a library that does not exist for PHP 8?

That is the most common hard case, and it has three answers: a maintained alternative doing the same job, a narrow in-house implementation of exactly what you actually use, or cutting the area off behind an interface of its own. Which answer holds goes into the assessment along with the effort, instead of surfacing in the middle of the implementation.

Can you take over a project whose developers have left?

That is the starting point in most of these projects. There is no documentation, no tests and nobody left to ask. The first step is then not a rebuild but understanding what the system really does today, including the quirks nobody planned and somebody still relies on. That inventory is part of the assessment anyway.

Do you handle the framework upgrade as well?

Yes, but as a project of its own, not on the side. A jump across several Symfony or Laravel major versions is regularly bigger than the language change itself and needs an order of its own. Doing both at once is the most reliable way to end up not knowing what a fault was caused by.

How much faster does PHP 8 make the application?

Measurably faster, but the order of magnitude depends on your application, not on the language. I will not quote a percentage from a brochure. What I do instead: measure the same paths before and after and put the number in the closing report.