PHP2Shell is the name for two critical holes in PHP itself, published on 21 October 2026 and already probed by attackers days before. They reach PHP 7.2 too, but PHP 7.2 is not on the list of versions that got a fix. Don't worry: we can upgrade your PHP 7.2 app to a patched PHP 8.4 release in 7 days. Find out how PHP2Shell works.
Our PHP 7.2 to PHP 8.4 upgrade services in USA and UK are for teams still running a release whose security support finished on 30 November 2020. Nearly six years later, PHP2Shell has landed, and PHP 7.2 sits outside the group of versions the PHP project chose to fix.
Here is the useful part: a PHP 7.2 app has probably been telling you what will break for years. PHP 7.2 deprecated each(), create_function() and __autoload(), and started warning when count() is called on something that is not countable. PHP 8.0 turned those warnings into removals and errors. Beyond that, 7.4 deprecated curly brace offsets like $str{0}, 8.0 changed loose comparison between strings and numbers, 8.1 deprecated nulls in internal function arguments and 8.2 deprecated dynamic properties.
Most PHP 7.2 apps also sit on a framework from the same years, such as Laravel 5.x or Symfony 3.4 and 4. We upgrade the framework step by step alongside the language, so the app ends on supported versions of both.
What changes when PHP 7.2 becomes PHP 8.4
The upgrade is less about new toys and more about getting back onto software that someone is still fixing.
Patched, then supported
PHP 8.4.27 closes both PHP2Shell flaws, and the 8.4 branch keeps getting security releases until the last day of 2028.
A framework that gets fixes
Laravel 5 and Symfony 3 no longer receive security patches. Your framework moves forward too, so the whole stack is covered, not just PHP.
Cleaner error logs
Years of deprecation notices get fixed, so real problems stand out in the logs instead of hiding under thousands of warnings.
Our PHP 7.2 upgrade checklist
- Deprecation log reviewed as the starting to-do list
- each(), create_function() and __autoload() replaced
- count() on null or scalars fixed with proper checks
- Curly brace offsets and old real casts rewritten
- Loose string and number comparisons checked for PHP 8 behaviour
- Laravel 5 or Symfony 3/4 upgraded version by version
- Dynamic properties declared on the classes that use them
- Go-live on a patched PHP 8.4 server, logs watched for two weeks
Our 7-day route off PHP 7.2
Day 1: Read the warnings
We pull your existing logs, run compatibility scans and list each deprecated call, package and framework step needed.
Days 2-4: Fix and climb
Code fixes and framework upgrades happen together on a PHP 8.4 copy, with tests run after each step.
Days 5-6: Compare
Checkout, sign-up, search and admin flows are tested against the 7.2 site. You approve the staging copy.
Day 7: Switch PHP
Production moves to PHP 8.4 at a quiet hour, and the previous build stays ready in case we need to roll back.
PHP 7.2 against PHP 8.4
Where a PHP 7.2 app stands today, and where it will stand after the upgrade.
| PHP 7.2 | PHP 8.4 | |
|---|---|---|
| Security support | Over since 30 November 2020 | In place until 31 December 2028 |
| PHP2Shell | Left without a fix | Closed in 8.4.27 |
| each() and create_function() | Deprecated, still work | Removed |
| Loose comparison | 0 == 'abc' is true | 0 == 'abc' is false |
| Frameworks it supports | Laravel 5, Symfony 3 and 4 | Current Laravel and Symfony releases |
| New syntax | object type, sodium | match, enums, readonly classes, property hooks |
Why hand your PHP 7.2 upgrade to us
A version jump and a framework jump at the same time need order and patience. We do them in small, tested steps.
One step at a time
We never jump four framework versions at once. Each step is upgraded, tested and committed before the next starts, so problems are easy to trace.
Fixed price after a free code scan.
Full Git history of every change we make.
PHP 7.2 upgrades for teams in the United States and United Kingdom
This upgrade is set up for US and UK businesses whose PHP 7.2 site or SaaS tool still makes money but has not had a platform update in years. We work from India on adjusted hours, overlapping with the US East Coast and the UK office day, and answer you the same day.
Every job starts with an NDA and ends with a fixed bill. Offshore rates mean you pay much less than a local agency for the same engineering work.
Official sources: PHP supported versions · PHP security releases · PHP 8.4 migration guide
Frequently asked questions
Straight answers about our PHP 7.2 to PHP 8.4 Upgrade service.
For most small and medium apps, 7 days, including the framework upgrade. When the codebase is very large we set out a phased plan, and the first part still goes live on PHP 8.4 within the same 7 days.
Yes. The flaws reach every version back to PHP 5. Official fixes exist only for PHP 8.2, 8.3, 8.4 and 8.5, so a PHP 7.2 server cannot be patched for it.
No. Laravel can be upgraded one major version at a time, and most of your controllers, models and views carry over with small changes. We follow the official upgrade guides and fix whatever your app adds on top.
PHP 8.0 changed how a number is compared with a non-numeric string. Code like checking 0 == $input can quietly give a different answer, so we search for those spots and make the comparisons strict.
No. All work happens on a copy. The switch on day seven takes minutes, at a time you choose, with a rollback ready.
Yes. We upgrade PHP apps for businesses across the United States and United Kingdom, keep hours that overlap with yours and agree a fixed price under NDA.
Is your PHP app still on an old version?
Send us the URL or the repository. We check it for the PHP2Shell flaw and old code for free, and tell you what a 7-day migration looks like.
Get a free migration audit