Security updates for PHP 8.2 end on 31 December 2026, and for PHP 8.1 and older they have already ended (As of 2026-10). We move long-running PHP applications, including those with Smarty templates and jQuery front ends, to PHP 8.4 or 8.5 and test every stage.
PHP & Craft CMS: taking over, updating and running applications
Our engineers have worked with PHP, Smarty, Slim and WordPress since 2012, and with Craft CMS as well. We take over applications that are years old and move them to a supported PHP version. We keep them running, including Smarty and Twig templates and jQuery front ends.
- PHP, Smarty and Slim experience since 2012
- Craft CMS and WordPress: takeovers, updates, plugins
- Reply within one working day
Where we use PHP and Craft CMS
Many PHP applications are older than the people who now look after them: shops, intranets, portals and business applications written for PHP 5 or 7. They run, but some hosting providers charge extra for them, the insurer asks questions and nobody dares to upgrade.
Taking over an orphaned application, updating it to a supported version and running it day to day are part of our engineers' routine. We also maintain, update and secure websites built with WordPress. The kinds of systems involved are described on the Experience page.
Craft CMS
For websites and portals with structured content in several languages, we use Craft CMS, a CMS built on PHP. We take over Craft projects from agencies, update them, write plugins and build new projects. This website also runs on Craft CMS. More under Craft CMS.
Typical tasks with PHP
- Taking over an orphaned application: the legacy review records access, repository, database, backups and risks; with the takeover follows a plan for the first 30 and 90 days.
- Upgrade to a supported PHP version, step by step and with tests. We check extensions, Smarty, jQuery and the database beforehand.
- Security and performance review: indexes, slow queries, WAF and access protection.
- Fixing vulnerabilities from penetration test reports (XSS, SQL injection), and preliminary vulnerability analyses.
- Further development for companies without their own developers.
- Interfaces with SOAP/XML and REST/JSON.
- Exposing proven logic as an API and building new functionality alongside it (Use the monolith as a web service).
- Moving a PHP application from traditional hosting into a container (From hosting to containers).
Rewrite or keep maintaining?
In most cases keeping the application and modernising it costs less and carries less risk than a rewrite. A running system contains years of business rules, special cases and fixes that are written down nowhere else. A rewrite has to rediscover all of them, and until it is finished, two systems need looking after.
Three paths are possible:
- Keep maintaining and update: if the problem is mainly the PHP version or outdated libraries, an update is enough. The application keeps its functions and data, and your team keeps working as before.
- Modernise in stages: the existing application stays in operation while new parts are added around it, for example a new front end or a separate service that talks to the old core through an interface. Old parts are replaced one at a time.
- Rewrite: worth considering when the framework is no longer maintained, there are no tests and the business rules can be fully written down.
Before we recommend a path, we look at the code, its dependencies and any existing tests. We will also tell you when a migration is not worth it.
Which PHP version are you running?
Each PHP version receives two years of active support and then two further years of critical security fixes only (As of 2026-10). After that there are no updates. Anyone starting today should aim for PHP 8.4 (updates until 31 December 2028) or PHP 8.5 (until 31 December 2029).
Support dates for PHP versions
| Date | Event | Source |
|---|---|---|
| 2018-12-31 | PHP 5.6: end of security updates. | php.net (opens in a new window) |
| 2019-01-10 | PHP 7.0: end of security updates. | php.net (opens in a new window) |
| 2019-12-01 | PHP 7.1: end of security updates. | php.net (opens in a new window) |
| 2020-11-30 | PHP 7.2: end of security updates. | php.net (opens in a new window) |
| 2021-12-06 | PHP 7.3: end of security updates. | php.net (opens in a new window) |
| 2022-11-28 | PHP 7.4: end of security updates. | php.net (opens in a new window) |
| 2023-11-26 | PHP 8.0: end of security updates. | php.net (opens in a new window) |
| 2025-12-31 | PHP 8.1: end of security updates. | php.net (opens in a new window) |
| 2026-11-19 | PHP 8.6: planned release (general availability). | wiki.php.net (opens in a new window) |
| 2026-12-31 | PHP 8.2: end of security updates. | php.net (opens in a new window) |
| 2027-12-31 | PHP 8.3: end of security updates. | php.net (opens in a new window) |
| 2028-12-31 | PHP 8.4: end of security updates. | php.net (opens in a new window) |
| 2029-12-31 | PHP 8.5: end of security updates. | php.net (opens in a new window) |
Smarty and jQuery
Smarty. The Smarty project provides security fixes only for the latest minor versions of Smarty 4 and 5; Smarty 2 and 3 are no longer supported (As of 2026-10). The path from version 3 via 4 to 5 mainly affects custom plugins, {php} blocks and PHP functions in templates.
jQuery. jQuery 4 is the current branch, and the 1.x and 2.x branches are no longer supported (As of 2026-10). Moving off old versions usually works via jQuery 3 or 4 with jQuery Migrate and by replacing individual plugins.
Technologies and scope
| Area | Scope |
|---|---|
| Language and frameworks | PHP, Smarty, Slim and WordPress since 2012 |
| CMS | Craft CMS: takeover, updates, plugins and new projects |
| Front end | jQuery and jQuery UI in long-running applications |
| Databases | MySQL and MariaDB, also with Galera, migrations for example from Firebird to MariaDB |
| Operations | Linux and Docker |
| Web servers | Nginx and Apache |
Typical starting points with PHP
-
-
Your system runs, but nobody knows it in detail. We record application, database, server and email, assess the risks, recommend the next step in writing and, if you wish, take over operations.
-
We move your Lucee, ColdFusion or PHP application from classic hosting into containers without rewriting it. That lets you rebuild, update and relocate the environment. Security updates for PHP 8.2 end on 31 December 2026 (As of 2026-10).
-
Your team is at capacity, a specific skill is missing, or you need a second opinion before an important decision? We take over a defined part: a module, the backend for your frontend, an interface, a migration or a code review. We work in your repository and ticket system, and the code and the knowledge stay with you.
The first step with a fixed scope and a fixed price
Legacy review
For companies with a system that nobody knows well any more: before an update, before a migration or when changing service provider.
- Inventory of versions and dependencies
- Map of application, database, server and email
- Risk register covering security, support and knowledge
- Assessment of backups and restores
- Recommendation “stay, upgrade or migrate” with an options matrix that also covers “move into a container” and “expose as an API”
- Effort estimate in days
The price covers one system, meaning one application with its database and its server. We price further systems individually.
What the result contains
A written report with inventory, risk register, recommendation and effort estimate. The report is yours.
PHP 8 compatibility scan
For companies with a long-running PHP application that want to know what will break under PHP 8 and how much work the upgrade takes.
- Inventory of PHP version, extensions, libraries and database
- Check of the code for places that no longer run under PHP 8
- Smarty templates and jQuery front end in the same pass
- List of incompatibilities ranked by risk and effort
- Staged plan up to the target version with an effort estimate in working days
We agree the scope and price in the intro call and confirm them in writing before we start. If you wish, the upgrade itself follows as a separate assignment.
What the result contains
A written list of incompatibilities with a staged plan and an effort estimate. The list is yours.
48-hour emergency assessment
For companies whose developer or service provider has suddenly left and whose system has to keep running regardless.
- Inventory: versions, dependencies, access, backups, scheduled tasks, data sources and outgoing email
- List of the risks that need attention immediately
- Stabilisation plan for the first 5 days and for the first 30 days
- Short meeting to go through the results
The result is with you 48 hours after we have access to the system. Changes to the production system and any further work happen only with your approval.
What the result contains
A written report on the state of the system, the immediate risks and the stabilisation plan. The report is yours.
A project with PHP 8
-
PHP 8.2 and the 30-second limit: pages waiting for the session lock
Web portals · 4 hours
After the move from PHP 7.4 to PHP 8.2, the same page loaded normally one moment and failed after 30 seconds the next. We rebuilt both versions side by side and found the cause: about 20 parallel AJAX calls of one user waited for the lock on the session file, one after another. Fixed with one line per script, without rewriting the application.
Questions about PHP applications
Do we have to rewrite our system to use a new stack?
No. If the old system is running, we expose its logic as an API and close known security gaps as a one-off step. Its behaviour is meant to stay unchanged, and comparison tests check that. We then build the new part alongside it in the new stack, and it uses that API.
A rewrite is rarely worthwhile. It becomes an option when the framework is no longer maintained, there are no tests and the business rules can be written down. The legacy review clarifies whether that applies to you.
What do we gain by moving to a container?
An environment that can be rebuilt. The same version and configuration apply on the developer's machine, on staging and in production, recorded in the repository instead of in one person's head. We test new versions of PHP, Lucee or ColdFusion alongside production and can roll them back. Moving to another server or another provider also becomes easier.
A container fixes no bug in the code and does not bring an unsupported version up to date. It only makes those changes easier.
Do you do frontend and backend, or backend only?
Both. Our engineers have worked as full-stack developers since 2012. Typical tasks are a new frontend for an existing backend and the maintenance of jQuery frontends that have grown over the years. For new projects we recommend a front end on Node.js, for example with Next.js and React. We discuss in the intro call whether that suits your system.
Do you build and integrate APIs (REST, SOAP)?
Yes. We build APIs and connect systems, with REST and JSON as well as SOAP and XML, including the synchronisation of data between applications. Typical use cases are described under Development and integration.
Which projects have you already delivered?
Our engineers have worked on these types of system:
- Loan processing platforms, including work directly for banks
- Platforms for mortgage financing
- Leasing platforms
- Systems that generate documents and contracts
- Video portals with streaming and automated video conversion
- High-traffic news and classifieds portals
- Web services of companies that work for the public sector, including cultural institutions
Selected projects are described in detail on the projects page, among them ColdFusion in production and under load, email deliverability, a shop flooded by bots and SQL indexes in a shop database.
Not sure which service fits your system?
Describe your system in two sentences. We will tell you which service fits and whether an entry product at a fixed price is the right first step.