PHP2Shell, two critical PHP flaws scored 9.2 on CVSS v4.0, went public on October 21, 2026, and an exploit attempt was recorded four days before the patch. PHP 7.x, 8.0 and 8.1 servers get no official fix, and servers on 8.2 or newer still need patching by hand. Lambda takes server patching off your list, and most small and mid-sized apps move in 7 days. Read our PHP update guide.
PHP to serverless migration services move PHP apps for US businesses off always-on servers and onto AWS Lambda functions, backed by managed services such as API Gateway, S3, SQS and RDS or DynamoDB. You stop renting a server that sits idle at night and stop logging in to patch it.
Two routes work. The first keeps your code in PHP: the open-source Bref project runs it on Lambda, and Laravel and Symfony work there with modest changes. The second rewrites hot paths in Node.js or Python, which have native Lambda runtimes. Many apps mix both, keeping the main app in PHP and moving jobs such as image resizing or report emails to small functions.
Techno Mantra is an AI and web development company that builds AI applications, websites, SEO programs and custom CRM systems for businesses in the US, Canada and Australia. You own the AWS account and all code.
What serverless changes for a PHP business
Serverless hands the dull, risky parts of hosting to AWS. Your code stays yours, and the operating system under it becomes Amazon's job.
No servers to patch
AWS maintains the Lambda hosts. With Bref, moving to a patched PHP release means updating one layer version and redeploying.
Pay for what runs
Lambda bills per request and compute time, so quiet sites and spiky campaigns both cost less than an oversized VPS.
Scales by itself
A sale, a TV mention or a bot spike gets more function instances automatically, with no 3 a.m. call to resize a server.
What the serverless move covers
- Architecture review: what runs as Lambda, what stays on a container
- PHP code upgraded to PHP 8.4 and packaged with Bref, or hot paths rewritten
- HTTP routes through API Gateway or Lambda function URLs
- Sessions and uploads moved off local disk to DynamoDB, Redis or S3
- MySQL moved to Amazon RDS or Aurora, with RDS Proxy where needed
- Cron jobs replaced by EventBridge schedules and queues by SQS
- Infrastructure as code with Serverless Framework or AWS SAM
- CloudWatch logs, alarms and a monthly cost estimate
7 days from server to serverless
Day 1: Architecture
Your code, traffic and cron jobs are reviewed, each part gets Bref or a rewrite, and you approve a fixed price.
Days 2-4: Package and wire up
Code moves to PHP 8.4, state leaves the local disk, and functions, API Gateway and RDS deploy through infrastructure as code.
Days 5-6: Load and cold-start tests
Load tests measure cold starts and timeouts, memory gets tuned, and you test the app on a staging URL.
Day 7: Cutover
DNS moves to API Gateway or CloudFront, alarms go on, and the old server stays as a short-term fallback.
PHP on a VPS vs serverless
Where your time and money go before and after the move.
| PHP on a server | Serverless on AWS | |
|---|---|---|
| Patching | You update the OS, web server and PHP | AWS runs the hosts, you bump the runtime layer |
| Cost model | Fixed monthly bill, even when idle | Per request and compute time |
| Scaling | Resize or add servers by hand | Automatic concurrency |
| Files and sessions | Saved on local disk | S3 for files, DynamoDB or Redis for sessions |
| Background jobs | crontab on one machine | EventBridge schedules and SQS queues |
| Limits | Few, but you manage everything | 15-minute run cap and cold starts to plan for |
Why we are a good fit for serverless
The audit names which parts should stay off serverless, so nothing is forced onto Lambda.
Honest architecture
Long-running jobs, WebSockets or heavy file processing may stay on containers, in a mix designed around your traffic.
Fixed build price, plus a written estimate of your monthly AWS bill.
NDA signed on request before code or cloud access.
Serverless PHP for US companies
This service is designed for companies across the United States that pay for servers they rarely need and patch them more often than they would like. Calls overlap US Eastern hours, and replies come within one business day.
You get one contact, a written plan, an NDA on request and a fixed go-live date, from a team with 5,000+ projects behind it. Clients in Canada and Australia get the same terms.
Official sources: PHP supported versions · AWS Lambda
Frequently asked questions
Straight answers about our PHP to Serverless Migration service.
Most small and medium PHP apps run on Lambda within 7 days: architecture on day one, packaging over three days, load tests on days five and six, cutover on day seven. Large apps get a phased plan, with the first routes serving live traffic within those 7 days.
Yes. Lambda has no built-in PHP runtime, but the Bref project maintains PHP layers for it, including PHP 8.4. A framework app runs once its storage, sessions and queues are adapted.
Partly. Code kept in PHP needs the patched release, and on Lambda the fix ships as a new Bref layer, with no server to log in to. Parts rewritten in Node.js or Python have no PHP left.
For most sites with uneven traffic, yes. Under heavy, constant load all day, a container on ECS or a plain server can cost less, and you get a cost estimate before you commit.
Functions stop at 15 minutes, cold starts add delay to first requests, and local disk is temporary. The design works around these, and anything that does not fit stays on containers.
Yes. Each US engagement runs remotely under one project manager, with call times that overlap the US Eastern day.
Is your PHP app still on an old version?
Send the URL or repository, under NDA if needed. The audit checks for the PHP2Shell flaw and outdated code and shows what a 7-day migration looks like.
Request a migration audit