PHP2Shell is out, and it is the most serious hole found in PHP for years. The two flaws reach all the way back to PHP 5, and the official fix only exists for PHP 8.2 and later, so a PHP 5.6 server has no patch coming at all. Don't worry: we take PHP 5.6 apps to a fixed PHP 8.4 release in 7 days. Learn what PHP2Shell does.
We offer PHP 5.6 to PHP 8.4 upgrade services in USA and UK markets for owners whose site still runs on a release that lost security support on 31 December 2018. That is close to eight years without a single fix, and PHP2Shell has turned that gap into a live threat.
This is the longest jump any PHP site can make, and it crosses five major breaking points. The old mysql_* functions vanished in PHP 7.0, together with ereg, split() and the /e flag on preg_replace. mcrypt left the core in 7.2. PHP 8.0 removed each() and create_function(), changed how strings compare with numbers and turned many warnings into fatal errors. 8.1, 8.2 and 8.4 then add their own deprecations on top.
So we plan it as a careful rebuild of the risky layers, not a version switch. Every query gets moved to PDO or mysqli with prepared statements, every removed function gets a modern replacement, and the site ends up on a patched PHP 8.4 release with the same pages and data your customers know.
What a PHP 5.6 site gains on PHP 8.4
The gap between these two versions is around a decade of engine work. Your business notices it in safety, speed and hosting choice.
Out of the danger zone
PHP 5.6 can never receive the PHP2Shell fix. PHP 8.4.27 carries it, and 8.4 keeps getting security releases until 31 December 2028.
Pages that load far quicker
The PHP 7 engine rewrite roughly halved memory use for typical apps, and PHP 8 added more gains on top. Old sites often feel new after the move.
Hosting that still exists
Most managed hosts and control panels have dropped PHP 5.6. On 8.4 you can pick any modern server, container or cloud plan again.
What the PHP 5.6 upgrade work covers
- Every mysql_* call rewritten to PDO or mysqli with prepared statements
- ereg, eregi and split() swapped for preg functions
- preg_replace /e patterns moved to preg_replace_callback
- mcrypt encryption replaced with OpenSSL or sodium, with stored data re-encrypted
- PHP 4 style constructors renamed to __construct
- each(), create_function() and other PHP 8 removals fixed
- Old Composer packages or hand-copied libraries replaced with supported ones
- Server moved to a patched PHP 8.4 build with a rollback copy kept
How we run the 7-day PHP 5.6 upgrade
Day 1: Map the old code
We copy the site to a private server, grep for every removed function and list each file, query and library that blocks PHP 8.4.
Days 2-4: Rewrite the data layer
The database code is rebuilt first because it touches everything. Then regex, encryption and constructor fixes follow, file by file.
Days 5-6: Prove it works
We click through every form, login, upload and report on PHP 8.4 and compare output with the PHP 5.6 copy until they match.
Day 7: Cut over
Your server switches to PHP 8.4 at a quiet hour. The old setup stays on standby so we can roll back within minutes.
PHP 5.6 compared with PHP 8.4
Ten years of changes, in the rows that matter most to a business site.
| PHP 5.6 | PHP 8.4 | |
|---|---|---|
| Security support | Ended 31 December 2018 | Runs until 31 December 2028 |
| PHP2Shell fix | None, and none planned | Included from 8.4.27 |
| MySQL access | mysql_* functions, often unescaped | PDO and mysqli with prepared statements |
| Encryption | mcrypt, long abandoned | OpenSSL and the sodium extension |
| Error handling | Warnings that fail silently | Exceptions you can catch and log |
| Language | No scalar types or return types | Union types, enums, readonly, property hooks |
Why trust us with a PHP 5.6 codebase
Very old PHP tends to hide surprises: copied libraries, inline SQL and logic no one has read in years. We expect that and plan for it.
We read the code before quoting
A free scan shows exactly how many database calls and removed functions your app has, so the fixed price is based on facts, not a guess.
Honest advice if a rebuild in Laravel would cost less than a repair.
Your data is never touched on the live server.
PHP 5.6 upgrades for businesses in the USA and UK
This work is aimed at US and UK companies whose online store, booking system or members area was built on PHP 5 and never moved forward. Our developers in India keep hours that overlap with US Eastern mornings and the full UK working day, so a question sent at lunch gets an answer the same day.
You sign an NDA before we see any code, you get one fixed price, and the offshore rate keeps the bill well under what a local agency in London or New York would charge for the same rewrite.
Official sources: PHP supported versions · PHP security releases · PHP 8.4 migration guide
Frequently asked questions
Straight answers about our PHP 5.6 to PHP 8.4 Upgrade service.
Yes. You do not need to install 7.0, 7.4 and 8.0 along the way. We fix the code for every change in between, then run it on 8.4 directly. The only thing that would stop it is code so tangled that a rebuild is cheaper, and we will tell you if that is the case.
Most small and medium PHP 5.6 sites are done in 7 days. Very large apps with hundreds of files get a phased plan, and the first part still goes live on PHP 8.4 within the same 7 days while the rest follows in stages.
It is the most common blocker, and it is fixable. PHP 7.0 removed the whole mysql extension, so we rewrite each call with PDO or mysqli and prepared statements, which also closes the SQL injection holes that old code usually has.
Yes. Both flaws reach every PHP release back to PHP 5, and the official fix was only shipped for 8.2, 8.3, 8.4 and 8.5. There is no patch for 5.6, so leaving the version is the only real defence.
We decrypt it with the old routine on a safe copy, re-encrypt it with OpenSSL or sodium, and test that every record reads back correctly before the new version goes live.
Yes. We work with business owners across the United States and the United Kingdom, overlap with your office hours, sign an NDA up front and agree a fixed price before any work begins.
Is your PHP app still on an old version?
Send us the URL or the repository. We check it for the PHP2Shell flaw and old code for free, and tell you what a 7-day migration looks like.
Get a free migration audit