The application is still needed.
It supports revenue or core processes and must remain maintainable for years.
PHP upgrade & migration
If your system runs on PHP 5.6, 7 or an early 8, it runs without security updates. The upgrade still gets postponed, because nobody can say what it will set off: dependencies without a successor, code without tests, and the people who wrote it are gone. I turn that into a project with a sequence, a way back and a date, while the system keeps running.
The entry point is a fixed-price assessment, implementation is quoted by scope. Also for systems without documentation and without the people who built them.
Remote from Germany. Straight with me, no agency in between.
The starting point
The language changes from PHP 7 to 8 are manageable and well documented. What makes projects fail sits next to them: a library whose last commit is seven years old. A framework three major versions behind. An extension that never existed for PHP 8. And a database driver that quietly compares differently than it used to.
If your system comes from PHP 5, the situation is a different one, and I will say so plainly: the break is not between 7 and 8 there, it is between 5 and 7. The old database functions were removed outright, errors became exceptions, and constructs such as each() or create_function() are gone. Projects like that therefore run in two stages over an intermediate version rather than in one jump, each stage live on its own and each reversible on its own.
On top of that comes the situation most enquiries grow out of. The code runs, it earns money, and the people who wrote it are no longer around. There are no tests, no documentation and nobody who can say why one place rounds the way it does. An upgrade is then not a maintenance task but a bet that you have found everything.
That is exactly why the work does not start in the code but with an assessment: what breaks, what might break, and which of it touches money. Only after that can anyone say whether the project takes two weeks or three months.
Does any of this sound familiar?Who this is for
For CTOs and technical leaders with a productive application on an old or unsupported PHP version. Security, hosting or library compatibility makes delay a growing risk.
It supports revenue or core processes and must remain maintainable for years.
Dependencies, test gaps and unknown effects require small steps with a clear way back.
The upgrade must coexist with delivery and leave the existing team able to continue.
What I do
Static analysis across the whole codebase, separated into genuine breaks, changed semantics and abandoned functions. Plus the dependencies: which packages exist for the target version, which are abandoned, which need a replacement. The result is a list with location, severity and estimated effort.
Where no tests exist, characterization tests come first: they record what the system does today, regardless of whether it is right. The net does not have to be complete, it has to cover the places that get touched and the paths that money hangs on.
Rector handles the mechanical part: type declarations, deprecated calls, changed signatures. A rule set per target version, in small runs, each one its own commit and reviewable on its own. Every run is produced as a preview first and read through, because the tool does not report where it was unsure: it changes whatever a rule matches and leaves everything else alone. What remains open after that goes on the manual list by hand.
The larger part of the effort rarely sits in the language, it sits in Composer. Packages move to maintained versions, abandoned ones get replaced, and where a framework is several major versions behind, the jump is broken into steps of its own. A Symfony or Laravel upgrade does not come along for free.
Not one cut-over date but a sequence of small changes, each one deployable on its own and reversible on its own. Where the architecture allows it, the new version runs for a share of the traffic first. Whatever shows up then shows up at one per cent, not at a hundred.
At the end come the things that stop the same conversation happening again in three years: static analysis in the pipeline, a dependency check as a recurring run, and a note about when the version you chose now falls out of support.
Is your PHP still on a version without security updates?
Send me the key facts. You get an assessment of what the upgrade means for you before you commission anything.
How it runs
Four steps, and after the first one you know what you are getting into. No step assumes that you commission the next one.
PHP version, framework, rough size, test coverage, where it gets deployed. Read access to the repository is enough for the assessment; production access is only needed later.
Static analysis and a dependency check, delivered as a list with locations, severity and effort, plus an order. That lets you decide, including against me.
A test net at the places that get touched. After that the automated runs, then the manual work. Every step a commit, every commit traceable on its own.
Into production in stages, with a way back. At the end checks in the pipeline and a handover, so your team carries on by itself from there.
Entry offer
Starting price for the assessment. Implementation is quoted by scope, at a fixed price, before it begins.
The entry point is an assessment, not an implementation: you find out what an upgrade means for you before you have to decide on it.
What you get
What you do not get
The outcome
Security updates arrive again, and the question in the next audit is answered without anyone having to justify an exception.
Current dependencies mean a new package can be installed without three others blocking it. That was the real standstill before.
The tests written for the upgrade belong to you afterwards. They protect the next change just as they protected this one.
Whether and how much faster your application runs on PHP 8 depends on the application, not on the language. So the same paths get measured before and after, and the figure goes into the closing report.
Technologies I use
Evidence
Most suppliers know the destination. With an old system, what decides the outcome is whether someone also knows the starting point: why a passage is written the way it is, and what replacing it sets off. Zend Technologies no longer exists under that name, and neither do the exams of the time. For the database side there is an Oracle certification on MySQL 5, because that is where the quieter traps sit: character sets, collations and a strict mode that starts refusing what used to pass.


From practice
A pending PHP 8 update was the trigger for modernizing a publishing platform grown over more than 20 years. Migration, a new search architecture and the platform move ran as three separate projects, each with its own way back, while the editorial team kept publishing.
Read the case studyAlso from real projects
The most common starting point for these enquiries, in detail: which breaks PHP 8.0 to 8.4 bring, why only the silent behaviour changes are dangerous, and what really drives the effort.
Read the article
Who you are talking to
I am Tim Rutte. More than 20 years in software development, most of it in PHP, from 5.x to today. You talk to the person who touches your code, from the first call to the handover.
Common questions
The assessment costs from 1,250 euros excluding VAT and tells you what the implementation costs. Without an analysis every number is a guess: two applications with the same line count can be a factor of ten apart, depending on whether the dependencies are maintained and whether tests exist. The implementation is quoted at a fixed price after the assessment, before it begins.
As of August 2026: PHP 8.2 until 31 December 2026, PHP 8.3 until the end of 2027, PHP 8.4 until the end of 2028 and PHP 8.5 until the end of 2029. Everything up to and including 8.1 is unsupported, PHP 7.4 since the end of 2022. As a target I usually recommend 8.4: a version that has been out long enough for the libraries to have caught up, and that still has more than two years of support.
No, that is a regular case. It is a different project from a jump off 7.4 though: the harder breaks sit between 5 and 7, the old database functions were removed outright, errors became exceptions. The route therefore runs over an intermediate version in two stages, each one live on its own and reversible on its own. I am a Zend Certified Engineer for PHP 5.3, so I know the starting world from more than the migration notes. What your case means is settled after the assessment, not before it.
Yes, and that is the normal case. Before the first change a net of characterization tests goes in, recording what the system does today. It does not have to be complete: it covers the places that get touched and the paths that money hangs on. That net stays with you afterwards.
No. The upgrade runs as a sequence of small changes, each one deployable on its own and reversible on its own. On the publishing platform from my case studies the modernization ran without a single day of downtime, even though language, search and platform all changed. What matters is keeping as little as possible in motion at once: there, the language switch, the new search and the platform move were three separate projects, each with its own way back.
That is the most common hard case, and it has three answers: a maintained alternative doing the same job, a narrow in-house implementation of exactly what you actually use, or cutting the area off behind an interface of its own. Which answer holds goes into the assessment along with the effort, instead of surfacing in the middle of the implementation.
That is the starting point in most of these projects. There is no documentation, no tests and nobody left to ask. The first step is then not a rebuild but understanding what the system really does today, including the quirks nobody planned and somebody still relies on. That inventory is part of the assessment anyway.
Yes, but as a project of its own, not on the side. A jump across several Symfony or Laravel major versions is regularly bigger than the language change itself and needs an order of its own. Doing both at once is the most reliable way to end up not knowing what a fault was caused by.
Measurably faster, but the order of magnitude depends on your application, not on the language. I will not quote a percentage from a brochure. What I do instead: measure the same paths before and after and put the number in the closing report.
Other services
Modernizing grown systems step by step: strangler fig instead of a rewrite, operations untouched, every step reversible.
Learn moreFrom an old Symfony release onto a maintained branch: clear the deprecations, replace the bundles, version by version, while the system keeps running.
Learn moreA PHP system without a developer: first understand what it does, then make it changeable again. Fixed price assessment, then further development or handover to your team.
Learn more