PHP2Shell, a pair of critical PHP flaws (CVSS 9.2), became public with its fixes on October 21, 2026. An exploit attempt was recorded four days earlier. Official fixes cover PHP 8.2 and newer. PHP 7.1 gets no official fix and no unofficial backport. Most small and mid-sized 7.1 apps reach a patched PHP 8.4 in 7 days. See the full news report.
PHP 7.1 to PHP 8.4 upgrade services take a US business app, built or last touched in the PHP 7.1 era, to a version that can be patched. PHP 7.1 stopped getting security releases on December 1, 2019, and nothing has fixed it since, PHP2Shell included.
PHP 7.1 is where many teams first added nullable types and void returns, so the code looks modern. The trouble sits in a few places. mcrypt was deprecated in 7.1 and removed from the core in 7.2, and data encrypted with it cannot be read without a plan. each() and create_function() vanished in PHP 8.0. PHP 8.1 objects to null passed into built-in functions, and PHP 8.4 deprecates the old habit of writing a typed parameter with a default of null and no question mark.
The upgrade repairs each one, updates the framework and libraries, and moves you to a PHP 8.4 release with the PHP2Shell fix.
Why PHP 7.1 apps should move to 8.4
Typed PHP 7.1 code carries over to PHP 8.4 with fewer changes than older code, so the 2017 investment keeps its value.
Covered until late 2028
PHP 8.4 gets security releases until December 31, 2028, including the PHP2Shell fix in 8.4.27. PHP 7.1 has had none since 2019.
Encryption you can trust
libmcrypt, the library behind mcrypt, has been abandoned for years. sodium and OpenSSL give your stored secrets a supported, audited library.
Stronger types
Union types, enums, readonly properties and never return types finish the job PHP 7.1's nullable types started, and more mistakes surface as clear type errors.
Work included in a PHP 7.1 upgrade
- mcrypt calls rewritten for sodium or OpenSSL
- Existing mcrypt data decrypted and re-encrypted safely
- each() loops and create_function() callbacks rewritten
- Parameters like Foo $x = null changed to ?Foo for PHP 8.4
- Null arguments to internal functions handled for PHP 8.1
- Serializable classes given __serialize and __unserialize
- Framework and Composer packages moved to PHP 8 releases
- Deployment to a patched PHP 8.4 server with rollback kept
Seven days from PHP 7.1 to PHP 8.4
Day 1: Audit
Rector in dry-run mode and PHPStan scan your code and find every mcrypt call, then you approve the scope and price.
Days 2-4: Convert
Encryption is moved first and tested record by record. Then type, loop and package fixes are applied on a PHP 8.4 copy.
Days 5-6: Verify
Your key flows are run on both versions and the results compared. You get a staging link to try it yourself.
Day 7: Release
The server changes to PHP 8.4 outside your busy hours, and error logs stay under close watch in the days after.
PHP 7.1 and PHP 8.4 side by side
The practical differences for a business app that started life on PHP 7.1.
| PHP 7.1 | PHP 8.4 | |
|---|---|---|
| Security releases | Stopped December 1, 2019 | Continue to December 31, 2028 |
| PHP2Shell | No fix available | Fixed from 8.4.27 |
| Encryption library | mcrypt, deprecated | sodium and OpenSSL |
| Nullable parameters | Implicit null default accepted | Explicit ?Type expected, implicit form deprecated |
| Type system | Nullable types and void | Union, intersection, DNF types, enums |
| Speed | PHP 7 engine | PHP 8 engine with optional JIT |
Why choose this team for PHP 7.1
Encrypted data is where a PHP 7.1 upgrade can go wrong, so it runs as its own small project inside the week.
Every record checked
Before launch, a test decrypts each re-encrypted value and matches it to the original, so no customer record goes missing.
Work done only on a copy of your database.
Price fixed before any code changes.
PHP 7.1 upgrade help for US firms
This offer suits small and mid-sized businesses in the US that rely on a PHP 7.1 app for orders, bookings or client records. Techno Mantra is an AI and web development company that builds AI applications, websites, SEO programs and custom CRM systems for businesses in the US, Canada and Australia.
An NDA, if you want one, comes first, then one fixed price. Calls overlap US Eastern hours, you get a reply within one business day and one named contact runs the project.
Official sources: PHP supported versions · PHP security releases · PHP 8.4 migration guide
Frequently asked questions
Straight answers about our PHP 7.1 to PHP 8.4 Upgrade service.
The whole upgrade takes 7 days for most small and mid-sized apps. A large codebase gets a phased plan: the first part goes live on PHP 8.4 within those 7 days, and the rest follows in planned steps.
Yes. PHP 7.1 sits outside every fix: official releases cover 8.2 and newer, and the unofficial source backports only reach 7.4, 8.0 and 8.1. The server stays exposed until the version changes.
It moves to sodium or OpenSSL. A one-off script decrypts each value with the old mcrypt settings and re-encrypts it. It runs on a copy first, and each value is verified before launch.
It is easier than older code, because typed PHP 7.1 code passes more checks. The work concentrates on removed functions, PHP 8.1 null handling, implicit nullable parameters in 8.4 and package updates.
Yes, if the app uses one. Framework versions from the PHP 7.1 years do not support PHP 8.4, so the team upgrades it in steps within the same job and fixed price.
Yes. The whole project runs remotely for companies in the United States, under an NDA on request and at one agreed price.
Is your PHP app still on an old version?
Send the URL or repository, under NDA if needed. The audit checks for the PHP2Shell flaw and outdated code and shows what a 7-day migration looks like.
Request a migration audit