A pair of critical PHP flaws known as PHP2Shell became public on 21 October 2026, with a CVSS score of 9.2 out of 10 and a path to running code on the server without a login. Fixes shipped only for PHP 8.2 and newer, so PHP 7.1 stays exposed. Don't worry: we bring PHP 7.1 apps up to a patched PHP 8.4 in 7 days. See the full news report.
If your app was built or last touched while PHP 7.1 was current, our PHP 7.1 to PHP 8.4 upgrade services in USA and UK take it to a version that can actually be patched. PHP 7.1 stopped getting security releases on 1 December 2019, and PHP2Shell gives attackers a fresh reason to look for servers like it.
PHP 7.1 is where many teams first added nullable types and void returns, so the code often looks modern. The trouble sits in a few places. mcrypt was deprecated in 7.1 and removed from the core in 7.2, and data encrypted with it cannot be read without a plan. each() and create_function() vanished in PHP 8.0. PHP 8.1 objects to null passed into built-in functions, and PHP 8.4 deprecates the old habit of writing a typed parameter with a default of null and no question mark.
We fix those, update the framework and libraries, and switch you to a current PHP 8.4 release with the security fix inside.
Why PHP 7.1 apps should move to 8.4
You already paid for typed, structured code in 2017. PHP 8.4 lets that code stay safe and keeps it running for years.
Covered until late 2028
PHP 8.4 gets security releases until 31 December 2028, including the fix for PHP2Shell in 8.4.27. PHP 7.1 has had none since 2019.
Encryption you can trust
mcrypt has not been maintained for over a decade. Moving to sodium or OpenSSL gives your stored secrets a supported, audited library.
Stronger types
Union types, enums, readonly properties and the never return type finish the job PHP 7.1's nullable types started, so whole groups of bugs stop compiling.
Work included in a PHP 7.1 upgrade
- mcrypt calls rewritten for sodium or OpenSSL
- Existing mcrypt data decrypted and re-encrypted safely
- each() loops and create_function() callbacks rewritten
- Parameters like Foo $x = null changed to ?Foo for PHP 8.4
- Null arguments to internal functions handled for PHP 8.1
- Serializable classes given __serialize and __unserialize
- Framework and Composer packages moved to PHP 8 releases
- Deployment to a patched PHP 8.4 server with rollback kept
Seven days from PHP 7.1 to PHP 8.4
Day 1: Audit
We run Rector in dry-run mode and PHPStan against your code, find every mcrypt call and agree the scope and price.
Days 2-4: Convert
Encryption is moved first and tested record by record. Then type, loop and package fixes are applied on a PHP 8.4 copy.
Days 5-6: Verify
Your key flows are run on both versions and the results compared. You get a staging link to try it yourself.
Day 7: Release
We change the server to PHP 8.4 outside your busy hours and watch the error logs closely for the next days.
PHP 7.1 and PHP 8.4 side by side
The practical differences for a business app that started life on PHP 7.1.
| PHP 7.1 | PHP 8.4 | |
|---|---|---|
| Security releases | Stopped 1 December 2019 | Continue to 31 December 2028 |
| PHP2Shell | No fix available | Fixed from 8.4.27 |
| Encryption library | mcrypt, deprecated | sodium and OpenSSL |
| Nullable parameters | Implicit null default accepted | Explicit ?Type expected, implicit form deprecated |
| Type system | Nullable types and void | Union, intersection, DNF types, enums |
| Speed | PHP 7 engine | PHP 8 engine with optional JIT |
Why we are a safe pair of hands for PHP 7.1
Encrypted data is the part of these upgrades that can go badly wrong, so we treat it as its own small project inside the week.
Every record checked
Before launch we decrypt each re-encrypted value and compare it with the original, so no customer record is lost in the move.
Work done only on a copy of your database.
Price fixed before we change a line.
PHP 7.1 upgrade help for American and British firms
This offer is designed for small and mid-sized businesses in the USA and the UK that rely on a PHP 7.1 app for orders, bookings or client records. We are an Indian team working shifted hours, so our day overlaps with New York mornings and the full London day, and messages get a same-day reply.
An NDA comes first, then one fixed price. Because we are offshore, the cost is a fraction of a comparable local agency, without giving up a named contact and daily progress notes.
Official sources: PHP supported versions · PHP security releases · PHP 8.4 migration guide
Frequently asked questions
Straight answers about our PHP 7.1 to PHP 8.4 Upgrade service.
For most small and medium apps it takes 7 days in total. If the codebase is very large, we agree a phased plan: the first part goes live on PHP 8.4 within those 7 days and the rest follows in planned steps.
Yes. It affects every PHP version back to PHP 5, and the PHP project only released fixes for 8.2 and newer. PHP 7.1 has no patch, so the server stays exposed until the version changes.
We write a one-off script that decrypts each value with the old mcrypt settings and stores it again with sodium or OpenSSL. It runs on a copy first, and every value is checked before launch.
Usually less hard than older code. Typed PHP 7.1 code tends to pass more checks. The main work is in removed functions, null handling from PHP 8.1, implicit nullable parameters in 8.4 and package updates.
Probably. Framework versions from the PHP 7.1 years do not support PHP 8.4. We upgrade the framework in steps as part of the same job and include it in the fixed price.
Yes. We upgrade PHP apps for companies across the United States and the United Kingdom, with an NDA, a fixed price and calls held in your own office hours.
Is your PHP app still on an old version?
Send us the URL or the repository. We check it for the PHP2Shell flaw and old code for free, and tell you what a 7-day migration looks like.
Get a free migration audit