Legacy PHP: takeover, care, upgrades
Your PHP app works. Nobody wants to touch it.
We take over PHP applications with technical debt, keep them secure and pay the debt down in stages, at fixed prices.
What you see is the smaller part
Above the water line
- Customers log in and orders go through.
- The hosting bill gets paid every month.
- Nobody has complained this week.
Below it
- PHP 7.4, without security fixes since 28 November 2022.
- A
composer.locknobody has updated in years. - No tests, so every change is a guess.
- The developer who understood it has left.
- A deploy that only works from one laptop.
Technical debt is not only a PHP 5 problem. A three-year-old Laravel or Symfony app can carry the same weight.
Usually something forces the question
A version reaches end of life
PHP 8.2 gets no security fixes after 31 December 2026. Laravel 12 follows on 24 February 2027.
Your developer or agency left
The code still runs, but nobody knows how to deploy it, and the documentation is an old README.
A security questionnaire arrives
A customer, an auditor or an insurer asks which software versions you run. The honest answer is uncomfortable.
Your host charges for old PHP
Some hosting providers now bill a monthly fee to keep outdated PHP versions running.
Due diligence is coming
An investor or a buyer will look at the code. It is better to know first what they will find.
From here on, it's our job.
We take responsibility for the application. We learn how it works, put a safety net of tests around it, keep it patched and tell you what we changed and why.
- One agreed price for each step, set after we have seen the app.
- Tests before changes, so nothing breaks unnoticed.
- Plain-language reports you can forward to your management.
- You talk to the engineer who does the work, with no account manager in between. See who you work with.
Three ways in
Not sure which one fits? Start with a diagnosis.
Keep it safe
Monthly care: PHP and dependency updates, monitoring, a backup before every change, and hours for fixes. The app stops falling behind. Care starts after a Takeover.
from €400 /month
Care plansPay down the debt
Upgrade PHP and the framework at a fixed price, or replace old parts in two-week sprints while the app keeps running.
Upgrades from €3,000
UpgradesTake it over
Your developer or agency left. We sort out access, make the app reproducible, add tests on the critical paths and write the runbook.
from €1,500
Takeover
How the first weeks look
Not every app needs every step. Each one has its own price, agreed before it starts.
01
Debt Check
You answer a questionnaire and send your
composer.lock. No code access. You get a short report: the risks in order of priority, a recommended path and price ranges.02
Code Audit
Under NDA, with read-only access, we run PHPStan, Rector and
composer auditand read the code. The report ends with fixed prices.03
Takeover
We make the app safe to change: a reproducible environment, CI, characterization tests and a runbook.
04
Care, upgrade or modernization
We keep it patched every month, upgrade it, or replace it in stages.
Some of the organizations we have worked for
Directly
- Tatra National Park
- Poczta Polska Usługi Cyfrowe (Envelo)
- NCBR+
- Jagiellonian University
- Ernst & Young
- Onet
- Alcar
Through agencies and partners
- Mercedes-Benz
- mBank
- Santander
- Orlen
- Rossmann
Latest notes
PHP 8.2 end of life on 31 December 2026: what to do now
PHP 8.2 gets no fixes from php.net after 31 December 2026. Find what keeps you on 8.2, pick 8.4 or 8.5, see what breaks, and plan B if you miss the date.
Questions we hear first
Do you only work with old PHP 5 apps?
No. Debt also builds up in recent apps: Laravel 9 or Symfony 5 with outdated packages, no tests, or nobody left who knows the code. We work with PHP 5 up to PHP 8.5.
Our developer left. Who maintains our PHP app now?
Will you want to rewrite everything?
Rarely. A rewrite stops your product for months and loses business rules nobody wrote down. We prefer to upgrade in place or replace parts in stages. If a rewrite really is the cheaper option, the audit will say so.
Which frameworks do you work with?
Any PHP framework, and apps without one too: Symfony, Laravel, Zend Framework 1 and Laminas, CodeIgniter, CakePHP or a custom one. Also platforms such as Sylius, when the problem is the PHP underneath.
How do you handle our code and access?
An NDA before we see a single file, read-only access first, and keys you create and can revoke. The code, servers and accounts stay in your name. Details in How we work.
Start with a Debt Check
€300, no code access, report within 3 business days. Or send us your composer.lock and PHP version.