PHP upgrade for WordPress, Laravel and legacy apps
php2shell (CVE-2026-109618 and CVE-2026-109619) is on CISA's exploited list. Old PHP is the exposed part.
A fixed-price move from an unsupported PHP version to a patched one: a version and exposure check, a staging copy, fixes for incompatible plugins or code, and a tested cutover with a rollback ready. For WordPress and WooCommerce sites, Laravel apps and older custom PHP.
By Eliran YihyeUpdated
From $295, fixed price
1 day to 4 weeks, by package
What it costs
| Price | From $295, fixed price |
|---|---|
| Timeline | 1 day to 4 weeks, by package |
| South Florida firms (Clutch) | 17 of 17 software and web firms list a minimum project above $295. Median minimum $10,000+, median hourly band $100-$149/hr. As of September 26, 2026. |
| Billing | Paid up front, fixed. Legacy modernization is quoted from $9,500 after the paid audit, which is credited. |
| Health check credit | The $295 PHP Health Check is credited toward any upgrade booked within 30 days. |
Market figures quoted on this page: PHP.net: 2026 release announcements, CISA: Critical vulnerabilities in PHP require immediate patching, PHP.net: supported versions, South Florida software firm rates on Clutch, 2026 census.
Start today
Pick a package and pay securely. You get an intake email within one business day.
Card, bank transfer (ACH), Cash App Pay or Amazon Pay, processed by Stripe. Rather talk first? Book a free call.
What is php2shell and does it affect my site?
php2shell is the name for CVE-2026-109618 and CVE-2026-109619, two critical remote code execution flaws in PHP itself. They are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and CISA added both to its exploited list on October 26, 2026. Any site on an older PHP is exposed.
How do I know which PHP version my website runs?
Our free PHP version checker reads what your site reveals and gives a plain-English verdict. Many hosts hide the version, so we also show where to find it in your hosting panel or in WordPress Site Health. If it stays hidden, a PHP Health Check confirms it for $295.
How much does a PHP upgrade cost?
At Cuanto Labs it is fixed: $3,500 for a standard WordPress site, $4,500 for WooCommerce or a complex site, and $5,500 for a Laravel or custom PHP app. Legacy PHP 5 to 7 apps start with a $950 audit, credited, then are quoted from $9,500. The $295 health check is credited too.
What does the $295 PHP Health Check include?
It confirms your PHP version and end-of-life status, including whether php2shell reaches you, scans your plugins, themes or packages for compatibility with a supported PHP, lists your hosting options, and ends in a written plan with a fixed price. If you book an upgrade within 30 days, the $295 is credited.
Can I just ask my host to update PHP?
Sometimes, and for a healthy site that is the right first step. The risk is that plugins, themes or old code stop working on the new version, which can take a site down. We test the upgrade on a staging copy first, so the switch is planned instead of a gamble.
How does Cuanto Labs' PHP upgrade price compare with South Florida firms?
Cuanto Labs starts at $295, fixed. 17 of 17 South Florida software and web firms on Clutch that publish a minimum project list one above $295, and the median minimum is $10,000+. Their median hourly band is $100-$149/hr. Clutch minimums cover any project type. Data as of September 26, 2026.
What is included
- PHP version and end-of-life check, including php2shell status
- Plugin, theme and package compatibility scan
- Staging copy so nothing is changed live until it works
- Fixes or replacements for incompatible code
- Checkout, payment and email flow testing for stores
- Cutover with a rollback ready
- Host options if your plan cannot run a supported PHP
- Written plan before any work starts
How it runs
- 1. Pay or book a scoping call. Pay for a package on this page, or book a call if your app does not fit one.
- 2. Check. We confirm your PHP version, whether php2shell reaches you, and what your plugins or packages need.
- 3. Staging. The upgrade is built and tested on a copy, never on the live site first.
- 4. Cutover. We switch over with a rollback ready and test the pages that earn money.
- 5. After. Regressions are fixed free for 30 days.
More questions
Do you upgrade sites you did not build?
Yes. Most upgrade requests are for sites another developer or agency built. We need hosting access and a backup, and we work on a staging copy first.
Will the upgrade break my site?
It can, which is why we never upgrade the live site first. We test a copy, fix what breaks, and cut over with a rollback ready. Regressions are fixed free for 30 days.
Related reading
Pick a time to talk it through
Loading the calendar…
Open the booking page30 minutes on Google Meet, free. Times shown in your local timezone.
Other services
Working locally? See how we run projects in Miami and Fort Lauderdale, or across South Florida.
A PHP upgrade changes the software your site runs on, and a point-in-time upgrade cannot guarantee that a site is free of vulnerabilities or that every plugin or package will work on a newer PHP. We test on a staging copy and keep a rollback ready. This is not a penetration test, a compliance certification or legal advice.