Closed Circuit Consultants · Las Vegas, NV · remote US
PHP upgrades from PHP 5 onward, to a version that still gets security fixes.
We move apps on PHP 5.x, 7.x, 8.0, and 8.1 to PHP 8.4 or 8.5, whether they run Laravel, WordPress, Symfony, CodeIgniter, or no framework.
On 21 October 2026 PHP fixed two critical remote code execution bugs, CVE-2026-109618 and CVE-2026-109619, in 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and older got no release. 7.4, 8.0, and 8.1 got source patches you build yourself.
Free 30-minute call. Written findings in 48 hours that you keep. Then a scoped SOW.
How it starts
Call → 48h upgrade findings → scoped upgrade
- 1. Free 30-minute call. We go over which PHP runs where, the framework or CMS, how you deploy, and who owns production.
- 2. 48-hour findings you keep. We record the PHP version on every server and container and list each package, plugin, and extension that blocks the target. PHPCompatibility and Rector dry runs find removed functions still in the code. The findings also say what your tests cover, which version to target, and the order of work.
- 3. Scoped upgrade. Fixed price for the upgrade, or from $2,500/month if you want us in the repo after.
Where PHP support stands
The dates are from php.net. A version without security support gets no fix from the PHP project when the next critical bug lands.
| Version | Security fixes |
|---|---|
| 5.6 and older | Ended 31 December 2018 |
| 7.0 to 7.3 | Ended between January 2019 and December 2021 |
| 7.4 | Ended 28 November 2022 |
| 8.0 | Ended 26 November 2023 |
| 8.1 | Ended 31 December 2025 |
| 8.2 | Ends 31 December 2026 |
| 8.3 | Ends 31 December 2027 |
| 8.4 | Ends 31 December 2028 |
| 8.5 | Ends 31 December 2029 |
What usually breaks on the way
PHP 5 to 7
PHP 7.0 removed the mysql_* functions and ereg, and 7.2 took mcrypt out of core. We rewrite the database and encryption code and migrate any data encrypted with mcrypt.
PHP 7 to 8.0
PHP 8.0 removed each() and create_function(). It also changed how strings compare to numbers, so some if statements now go the other way without raising an error.
PHP 8.0 to 8.2
PHP 8.1 deprecated passing null to built-in functions that expect a value, and 8.2 deprecated dynamic properties. Old plugins and packages trigger both, and the warnings fill the logs.
The framework or CMS
An old Laravel, Symfony, or CodeIgniter release, or an abandoned WordPress plugin, may not run on the target PHP at all. In that case it moves in the same plan.
Proof
Who does the work
Sean O'Dea, CISSP, GPEN. We have run Laravel in production since 2020. Our own Laravel apps were on a supported PHP branch on 21 October 2026, so the fix for both bugs reached them without a redeploy.
Laravel app with nobody left who knows it? See Laravel codebase takeover. Want the code reviewed for more than the PHP version? See security in the build.
Questions
Which PHP versions do you upgrade from?
PHP 5.x, 7.0 through 7.4, 8.0, 8.1, and 8.2. The older the version, the more the findings cover, but none of them are too old to move.
Which PHP version should we upgrade to?
PHP 8.5 gets security fixes until 31 December 2029. PHP 8.4 gets them until 31 December 2028, and is the target when a dependency is not ready for 8.5. We do not recommend stopping at 8.2, whose security support ends 31 December 2026, or 8.3, which ends 31 December 2027.
Are we exposed to the October 2026 PHP remote code execution bugs?
If PHP serves web requests through PHP-FPM, mod_php, php-cgi, FrankenPHP, or LiteSpeed, and you run anything older than 8.5.12, 8.4.27, 8.3.36, or 8.2.35, the PHP security advisory for CVE-2026-109618 and CVE-2026-109619 says yes. PHP 8.1 and older got no release from the PHP project.
Can you reduce our exposure while the upgrade is planned?
Yes. We apply the interim settings from the PHP advisory and any backported package your distribution or LTS vendor ships. The PHP project says only an update is a complete fix, so the upgrade still happens.
We run WordPress, Symfony, CodeIgniter, or no framework. Do you take those?
Yes. Laravel, WordPress, Symfony, CodeIgniter, and plain PHP. The findings list every plugin, bundle, Composer package, and extension that will not run on the target PHP, and what replaces it.
Do we have to upgrade the framework too?
Often. If your framework or CMS version does not run on the target PHP, the findings put both upgrades in one plan, in the order they have to happen.
Can the site stay up during the upgrade?
Yes. The upgraded app runs next to the old one on the new PHP first. Cutover happens in a window you pick, and the old runtime stays available as a rollback until you sign off.
What does it cost, and how long does it take?
We do not quote either before the findings. The 30-minute call is free. The 48-hour findings become a scoped SOW: a fixed price for the upgrade, or a retainer from $2,500/month if you want us in the repo after.
Get back on a PHP that gets patched.
Book the free call. Bring the output of php -v from production.
Closed Circuit Consultants · SOC LLC d/b/a · Las Vegas, NV · remote across the US