Sites on PHP 5.4 through 8.1 are exposed to CVE-2026-109618 and CVE-2026-109619 and will not receive a patch. The fix is upgrading to PHP 8.2 or newer (we recommend 8.3 or 8.4). Because PHP 8 removed functions older code relies on, the upgrade is done on staging first. Our Legacy PHP Upgrade starts at $890, fixed quote, no fix, no fee.
What breaks when you upgrade old PHP?
Every major PHP release removes or changes behavior that old themes, plugins and custom code depend on. The further back you start, the more there is to fix:
| Upgrade jump | Typical breakage | Symptom |
|---|---|---|
| 5.6 → 7.0 | mysql_* functions and ereg removed; PHP 4-style constructors deprecated | Fatal error, white screen, database errors |
| 7.x → 8.0 | each(), create_function(), money_format() removed; stricter type errors in internal functions; changed string-to-number comparisons | Fatal errors, wrong logic in conditions |
| 8.0 → 8.1 | Passing null to non-nullable internal parameters deprecated; $GLOBALS write restrictions | Deprecation floods in logs, broken legacy code |
| 8.1 → 8.2+ | Dynamic properties deprecated; utf8_encode() and ${} string interpolation deprecated | Warnings today, errors in future versions |
See a real before/after example on our home page.
Our upgrade process, step by step
- Scan. Automated compatibility scanning with PHPCompatibility (PHP_CodeSniffer) and Rector lists every incompatible line across your codebase.
- Staging. A full copy of your site on the target PHP version. Your live site keeps running untouched.
- Update third-party code. CMS core, plugins, modules and Composer packages are updated to PHP 8-compatible releases, not rewritten.
- Fix custom code. Your theme, custom plugins and in-house code are rewritten where needed.
- Replace the abandoned. Plugins with no PHP 8 release get a maintained alternative, with your approval.
- Test. Key journeys: pages, forms, search, checkout, logins, admin, scheduled tasks and emails.
- Switch and watch. Live switch with a tested rollback, then error logs are monitored.
WordPress, Drupal, Magento, Joomla and custom PHP
- WordPress: core, themes and plugins updated; custom theme code fixed. See WordPress PHP update.
- Drupal: Drupal 7 and old Drupal 8/9 sites often need module and core upgrades before PHP 8.3 is possible. Usually scoped as Complex Stack Rescue.
- Magento / Adobe Commerce: each Magento release supports specific PHP versions, so the PHP upgrade usually travels with a platform upgrade. Complex Stack Rescue.
- Joomla: extensions and templates checked for PHP 8 support, then core updated.
- Laravel and custom PHP: Composer dependencies updated and code modernized with Rector, then tested.
PHP 8.1 end of life: why waiting doesn't work
PHP 8.1 and older no longer receive updates from the PHP project, and security reporters estimate that a large share of PHP websites still run these older versions. Every future PHP vulnerability will also stay unpatched on them. Upgrading now fixes this emergency and the next one.
Is your site a simple brochure or showroom site? A Static Rebuild (from $490) removes PHP entirely and can cost less than an upgrade.
Frequently asked questions
Can PHP 7.4 or PHP 8.1 be patched for CVE-2026-109618?
No. No official patch exists for PHP 8.1 and older. The site must be upgraded to PHP 8.2 or newer, ideally 8.3 or 8.4.
How much does it cost to upgrade PHP 7.4 to PHP 8.3?
Our Legacy PHP Upgrade starts at $890 per website. You get a fixed quote after a free check, and nothing starts before you approve it. Large Drupal, Magento or custom applications are scoped as Complex Stack Rescue from $1,900.
How long does a legacy PHP upgrade take?
Typically 2–5 business days, because every change is tested on a staging copy before your live site is switched.
What does 'no fix, no fee' mean?
If we can't complete an agreed upgrade, your deposit is refunded minus any third-party costs you approved in advance.
Can you just rewrite my old PHP code?
Custom code, yes. We find each incompatible line and rewrite it in modern PHP. CMS core, plugins and modules are updated to PHP 8-compatible versions rather than rewritten, and abandoned ones are replaced.
Can I just switch PHP versions in cPanel myself?
You can, but jumping from 7.x or 8.0 to 8.3 on a live site often causes a white screen or a broken checkout. If you do it, take a full backup first and know how to switch back.
Get off unpatched PHP for good
Free check, fixed quote, staging-first upgrade. From $890, no fix, no fee.
Related services
Last updated October 22, 2026. LegacyPatch is an independent service provider and is not affiliated with The PHP Group. Prices in USD; GBP and EUR invoices on request.