Should I Upgrade or Rebuild My Old PHP App?

Should I upgrade or rebuild my old PHP app?

In most cases, upgrade in stages. If the app does its job and your team knows how it works, a step-by-step modernization costs less and carries less risk than a rebuild. Rebuild only when the code cannot be changed safely, or when the business itself has moved on from what the app does.

A short audit settles the question with facts instead of opinions. It looks at the PHP version, the framework, the tests and the packages, then gives you a written path.

Why does an old PHP app become urgent now?

Old PHP stops getting security fixes, and the gap is now visible. The PHP supported versions page no longer lists 8.1 or older, and 8.2 reaches the end of security support on December 31, 2026. That puts most old custom apps on borrowed time, so planning now is cheaper than a rushed rebuild later.

The php2shell flaws, announced October 21, 2026, brought this home. The PHP team said 8.1 and older no longer receive updates, and shipped minimal backports for 7.4, 8.0 and 8.1 only because of the severity. CISA's alert advises organizations that continue to use PHP 8.1 or earlier to take PHP-based systems offline until patched. Read our php2shell explainer for context.

How common is outdated PHP?

Very. W3Techs reports that among sites using PHP, 26.6 percent run version 7, 7.7 percent run version 5 and 0.1 percent run version 4, as of October 27, 2026. That is about 34 percent on a major version that ended support years ago.

If your app is one of them, you are not alone, but you are carrying risk that grows each month. You can check a public site with our free PHP version checker.

What does modernizing a legacy PHP app involve?

Modernization is a set of small, checked steps, not one big leap. The aim is to keep the app running while its foundations are replaced piece by piece. Typical steps include a backup and test setup, an upgrade to a supported PHP version, replacing dead libraries, and adding tests so each change can be checked.

• • Audit. Record the PHP version, framework, database, packages and hosting.
• • Tests first. Write tests around the behavior that matters, so changes can be proven safe.
• • Upgrade path. Move through supported versions in an order that keeps the app working.
• • Replace dead parts. Swap abandoned packages and move the riskiest modules first.
• • Framework move, if justified. Only when it saves money over time.

This staged approach is sometimes called the strangler pattern: new code takes over old code one piece at a time. It avoids a long freeze where nothing can change.

When does a rebuild make sense?

A rebuild fits when staged work would cost more than starting fresh. Use this table as a rough guide. One sign alone is a reason to look closer, not to decide. If several apply at once, a rebuild is usually the calmer and cheaper path over the next few years.

Rebuilds carry a hidden cost: the old app holds years of small decisions about edge cases. A rebuild must rediscover each one, and some are only found after launch.

What does legacy PHP modernization cost at Cuanto Labs?

Legacy PHP Modernization starts from $9,500 after a $950 audit, which is credited toward the work. It covers old or custom PHP 5 to 7 apps: audit, tests, an upgrade path and a framework move if it is justified. It takes 6 to 8 weeks and carries a 30-day warranty.

If your app is a Laravel or standard custom app on a more recent PHP, the fixed Laravel and custom app upgrade is $5,500. We compare costs in How Much Does a Laravel Upgrade Cost in 2026?. Start with the PHP upgrade service.

Can I just pay my host for extended support?

Sometimes, as a stopgap. GoDaddy, for example, moved PHP 8.1 to a paid PHP Extended Support add-on on January 1, 2026. Ask whether it covers a specific flaw, and treat it as a bridge with an end date, not a plan.

What does Cuanto Labs do for clients?

We start with the audit and give you a written recommendation: upgrade, partial rewrite or rebuild, with a price range and a timeline for each. You decide. If you pick an upgrade, we work on a staging copy, test the behavior that matters and switch over with a rollback ready.

Afterward, a website care plan keeps PHP and packages current. We cannot promise zero problems, but we can make the path clear and the work visible.

Frequently asked questions

Can an old CodeIgniter or CakePHP app move to a newer PHP?

Often yes, in stages, depending on the version and the packages involved. The audit shows how far each piece has to move.

Do I need the original developer?

No. We can work from the code itself. Having documentation helps, but we do not depend on it.

How long will the app be unavailable?

Usually not at all. Work happens on a copy and the switch is planned.

Next step

If your app is on old PHP, book a call and send us the PHP version if you know it. We will tell you whether this week is the week to act.

This article is general information, not legal or compliance advice. Written by Eliran Yihye, founder of Cuanto Labs, on October 27, 2026.