PHP2Shell, the worst PHP security hole in years, went public on 21 October 2026. It can let someone run their own code on your server without a password, and no patch will ever come for PHP 8.1 and older. Don't worry: we move the risky or heavy part of your PHP app to Rust and have that first phase live in 7 days. See how to update PHP for the rest.
Our PHP to Rust migration services in USA and UK companies start with an honest question: which part of your PHP app really needs Rust? Rust gives you C-level speed with memory safety checked by the compiler, but it takes longer to write than most languages. We use it where it pays for itself, such as a pricing engine, a file or image pipeline, a busy API or a service that handles untrusted input.
New services are built with Axum on the Tokio async runtime, talk to the database through SQLx with queries checked at compile time, and use serde for JSON. Each one ships as a single binary, often with a container image under 50 MB, and runs next to your remaining PHP code until you decide what else should move.
We are a web development company in Gujarat, India with more than a decade of practice. Our day overlaps with US Eastern and UK hours, and we explain Rust trade-offs in plain business terms.
When Rust is the right move from PHP
Rust is a strong choice for a narrow set of problems. If yours is one of them, the gains are large and they last.
Memory safety by default
The borrow checker rejects buffer overruns, use-after-free and data races before the code ever runs, which matters for any service that parses outside input.
Speed with steady latency
No garbage collector pauses and no interpreter. CPU-heavy work such as reports, image processing or price calculation can run many times faster than in PHP.
Errors you cannot ignore
Rust's Result type forces every failure path to be handled, so a failed payment call or bad file never slips through silently.
What a PHP to Rust project covers
- Audit to pick the PHP modules where Rust gives real value
- New Axum service on Tokio for the chosen endpoints
- Database access with SQLx and compile-time checked SQL
- JSON handling with serde, matching your current API fields
- Auth tokens and password hashes shared with the PHP side
- Calls from PHP to Rust over HTTP or a queue during the transition
- Unit and integration tests with cargo test
- Container build and CI for your cloud or servers
Phase one of your Rust migration, in 7 days
Day 1: Pick the target
We profile the PHP app, choose the module where Rust helps most, define its API contract and fix the price for phase one.
Days 2-4: Build in Rust
Axum handlers, SQLx queries and the ported business rules, with tests that pin each result to what PHP produces today.
Days 5-6: Prove it
Side by side runs on staging compare outputs with PHP, and a benchmark shows speed and memory use on your real data.
Day 7: Release phase one
The Rust service takes live traffic for that module while the rest of the app keeps running, and we agree the next phase with you.
PHP vs Rust in production
What moves when a PHP module is rebuilt in Rust.
| PHP module | Rust service | |
|---|---|---|
| Memory safety | Relies on the PHP engine, which itself had PHP2Shell | Checked by the Rust compiler |
| CPU-heavy work | Slow for large loops and number crunching | Compiled native code |
| Error handling | Exceptions and warnings that can be missed | Result types that must be handled |
| Latency | Varies with worker load | Steady, with no garbage collector |
| Build time | None, code runs as written | Slower compiles, more upfront effort |
| Best for | Pages, CMS and quick changes | Hot paths, parsers and high-load APIs |
Why trust us with a Rust rewrite
Rust projects fail when teams try to rewrite everything at once. We start small, prove the gain and only then go further.
We will say no when Rust is wrong
If a PHP 8.4 upgrade or Go would serve you better and cost less, the audit says so in writing, before you spend money on a rewrite.
Fixed price for each phase, set after a free audit.
NDA signed before any code is shared, and you own everything we write.
Rust migration for US and UK engineering teams
We set this service up for software companies, fintech and data businesses in the United States and the United Kingdom that have a PHP core and one or two parts that are too slow or too risky. Our hours meet the US Eastern morning and the UK afternoon, and replies come the same day.
Rust developers are scarce and costly in American and British cities. Our offshore team brings that skill at a lower rate, with a fixed price per phase and an NDA from the start.
Official sources: PHP supported versions · Rust
Frequently asked questions
Straight answers about our PHP to Rust Migration service.
A small service can be rebuilt in Rust in 7 days. A full rewrite of a large PHP app takes much longer, so we always run it as a phased plan: the first module goes live inside 7 days, then each further phase gets its own date and price.
Rarely. Admin screens and content pages gain little from Rust. We usually move the slow or security-sensitive parts and keep or upgrade the rest.
Yes. The Rust service exposes an HTTP API or reads from a queue, and your PHP app calls it. Users see one product while the parts move over time.
Rust has a learning curve. We keep the code idiomatic and documented, and offer handover sessions, but if nobody on your team will touch Rust, Go may be the safer pick.
Any part rebuilt in Rust no longer runs on PHP, so the flaw does not apply there. The PHP that remains still needs an upgrade to a fixed release such as PHP 8.4.27, which we can do in the same week.
Yes. We hold calls in US Eastern or UK hours, reply the same day, sign an NDA and quote a fixed price for each phase of the work.
Is your PHP app still on an old version?
Send us the URL or the repository. We check it for the PHP2Shell flaw and old code for free, and tell you what a 7-day migration looks like.
Get a free migration audit