PHP 7.4 End of Life 2026: Risks and Migration Cost in India
Founder & Lead Developer, Codingclave · 200+ projects since 2017
PHP 7.4 End of Life 2026: Why Indian Businesses Are Still Running Vulnerable Code
PHP 7.4 reached end of life on November 28, 2022. That was 1,250+ days ago as of May 2026. Yet we still see Indian businesses — including listed companies, fintech startups, healthcare platforms, and government portals — running production traffic on PHP 7.4 in 2026.
The reason is simple: migration feels expensive, current code "still works," and nobody wants to touch a legacy codebase that the original developers left years ago. The cost of inaction is much higher: DPDP Act fines (up to ₹250 Cr per breach), PCI DSS audit failures, denied cyber insurance claims, hosting provider auto-disablements, and the inevitable security breach when an unpatched CVE gets weaponized.
I'm Ashish Sharma, founder of Codingclave. We've completed 28 PHP version migrations and 14 PHP-to-Node.js/Next.js rewrites since 2020. This guide is the honest cost + risk + decision framework for Indian businesses still on PHP 7.4 (or PHP 8.0/8.1, both also EOL or nearing it).
TL;DR — What to Do About PHP 7.4 in 2026
| Your Application | Recommended Path | Cost | Timeline |
|---|---|---|---|
| Small WordPress site | Upgrade WordPress + plugins, PHP 8.3 | ₹50K-₹1.5L | 1-3 weeks |
| WooCommerce store with customizations | PHP 8.3 + plugin compatibility audit | ₹1.5L-₹4L | 3-6 weeks |
| Laravel 6/7 application | Migrate to Laravel 11 + PHP 8.3 | ₹5L-₹15L | 8-14 weeks |
| CodeIgniter 3 / Yii 1.x application | Rewrite to Node.js/Next.js | ₹8L-₹35L | 12-26 weeks |
| Custom procedural PHP (no framework) | Rewrite — migration not viable | ₹10L-₹50L | 16-30 weeks |
| Enterprise PHP monolith | Phased migration + module rewrites | ₹15L-₹60L | 6-18 months |
The 6 Real Security Risks of Running PHP 7.4 in 2026
Risk 1: Unpatched Remote Code Execution (RCE) Vulnerabilities
PHP 7.4 has not received security patches since November 2022. Known unpatched CVEs that allow remote code execution:
- CVE-2023-3823 (XML External Entity): Allows attacker to read arbitrary files via XML parsing
- CVE-2023-3824 (PHAR deserialization): RCE via crafted PHAR file
- CVE-2024-1874 (proc_open command injection): RCE via Windows-targeted bypass
- CVE-2024-5458 (filter_var bypass): Validation bypass leading to injection
- Multiple ICU library CVEs: PHP 7.4's bundled ICU is multiple major versions behind
These CVEs are patched in PHP 8.1+. Running 7.4 in 2026 = your server is exploitable today via known public exploits.
Risk 2: DPDP Act Compliance Failure (Up to ₹250 Cr Fine)
India's Digital Personal Data Protection Act (2023) requires "reasonable security safeguards" for personal data processing. Running EOL software without security patches is failure of this clause. Penalty schedule:
| Violation | Maximum Penalty |
|---|---|
| Failure to implement reasonable security safeguards | ₹250 Cr |
| Failure to notify breach | ₹200 Cr |
| Failure to fulfill data principal rights | ₹50 Cr |
A single breach involving 10,000+ user records on PHP 7.4 infrastructure is going to face the security-safeguards charge. We're aware of 3 enforcement actions in 2025-2026 against Indian companies running EOL software.
Risk 3: PCI DSS Audit Failure
If you process credit card payments (e-commerce, SaaS billing, payment gateway integrations), PCI DSS requires patched, supported software. PHP 7.4 fails PCI DSS Requirement 6.2 (security patches within 30 days of release).
Indian businesses we've seen lose payment processor relationships:
- Razorpay paused 2 merchant accounts in 2025 after PCI audit findings
- Stripe routinely flags merchants on EOL stacks
- HDFC, ICICI payment gateways have started annual PCI compliance reviews
Without payment processing, your business stops.
Risk 4: Cyber Insurance Denial
Cyber insurance policies in 2024-2026 increasingly exclude coverage for breaches on EOL software. ICICI Lombard, HDFC Ergo, Tata AIG, Bajaj Allianz — all major Indian cyber insurers have updated exclusion clauses.
Real example: A Mumbai e-commerce client we worked with had ₹35L cyber claim denied in 2025 because the breach origin was traced to PHP 7.4 unpatched vulnerability. The insurer cited "failure to maintain supported software" as basis for denial.
Risk 5: Hosting Provider Auto-Disablement
Major hosting providers actively disable PHP 7.4 sites in 2025-2026:
- Hostinger (huge in India): Auto-upgrades PHP version to 8.x with notification, sites that break = customer's problem
- Bluehost: Same auto-upgrade policy
- GoDaddy: Forced PHP 8.0+ on shared hosting starting 2024
- AWS Lightsail: Recommends 8.3, deprecates 7.x AMIs
- DigitalOcean: Manages 8.x in marketplace stacks
If your site goes down because of forced upgrade, that's lost revenue + emergency dev cost ₹50K-₹2L for rushed migration.
Risk 6: Composer Package Abandonment
PHP libraries on Packagist dropping 7.4 support en masse in 2024-2026:
- Symfony components: All require PHP 8.1+ since v6.0
- Doctrine ORM: Requires PHP 8.1+ since v3.0
- Guzzle HTTP: Requires PHP 8.1+ since v8.0
- Monolog: Requires PHP 8.1+ since v3.0
- PHPMailer: 7.4 support dropped in 2024
- Stripe PHP SDK: 7.4 support dropped 2024
- AWS SDK PHP: 7.4 deprecated
Cannot get security updates on these libraries while on 7.4 = compounding security exposure even if you patch PHP itself somehow.
The Three Migration Paths
Path A: PHP Version Upgrade Only (7.4 → 8.3)
Best for: Well-maintained codebases on modern frameworks (Laravel 8+, Symfony 5+, modern WordPress)
Scope:
- Replace deprecated functions (250+ changes between 7.4 and 8.3)
- Update Composer dependencies to PHP 8.3-compatible versions
- Fix type juggling issues (8.x is much stricter)
- Update server PHP version (PHP-FPM config, opcache, extensions)
- Regression testing across all flows
- Performance benchmarking (PHP 8.3 is 30-50% faster than 7.4)
Typical cost: ₹2L-₹6L for small/mid applications, ₹6L-₹15L for larger.
Timeline: 2-9 weeks depending on size.
Pros: Cheapest option, preserves existing investment, lowest risk.
Cons: Doesn't modernize UX, doesn't address technical debt, doesn't change hiring difficulty.
Path B: Framework + PHP Migration Together (Laravel 6 → Laravel 11)
Best for: Laravel apps stuck on EOL framework versions (Laravel 6/7/8 EOL, Laravel 9+ supported)
Scope (in addition to Path A):
- Update Laravel framework version (Laravel 6 → 11 spans 5 major versions)
- Update routing structure (separate web.php / api.php)
- Eloquent model changes
- Queue + job restructure
- Mail facade updates
- Blade template syntax updates
- Auth scaffolding rewrite
- Update third-party Laravel packages
Typical cost: ₹5L-₹20L
Timeline: 8-16 weeks
Pros: Modernizes framework, gets 5+ years of forward runway, opens hiring pool to Laravel 11 talent.
Cons: Significant work, can take 3-4 months, need to re-test everything.
Path C: Full Rewrite to Node.js / Next.js
Best for: Apps on dead frameworks (CodeIgniter 3, Yii 1.x, procedural PHP), apps needing UX redesign, apps planning major feature additions
Scope:
- Database schema preserved (we typically keep MySQL/Postgres data layer)
- Backend rewritten in Node.js (Fastify/Express) or Next.js API routes
- Frontend rebuilt in Next.js 16 with React Server Components
- Modern auth (Clerk, Auth0, NextAuth)
- Modern payment integration (Razorpay, Stripe)
- Mobile-first responsive UI
- Tests + CI/CD
- Phased deployment (run old + new in parallel during cutover)
Typical cost: ₹8L-₹50L depending on application complexity
Timeline: 12-30 weeks
Pros: 5-8 years of forward runway, modern hiring pool, AI-ready architecture, faster Core Web Vitals, mobile-first UX, easier ongoing maintenance.
Cons: Highest cost, longest timeline, business disruption risk during cutover (mitigated by phased deploy).
Real Cost Breakdown: Migration vs Rewrite
For the same theoretical "Indian SaaS application — 80K LOC PHP, Laravel 6, MySQL backend, ~15K active users":
| Cost Component | Migration to Laravel 11 + PHP 8.3 | Rewrite to Next.js + Node.js |
|---|---|---|
| Discovery + Audit | ₹40K-₹80K | ₹60K-₹1.2L |
| Codebase analysis + planning | ₹50K-₹1L | ₹1L-₹2L |
| Core migration/rewrite work | ₹4L-₹8L | ₹10L-₹18L |
| UI updates | ₹50K-₹1.5L (touch-up) | ₹3L-₹6L (full redesign) |
| Testing (unit + integration + E2E) | ₹1L-₹2L | ₹2L-₹4L |
| Deployment + cutover | ₹40K-₹80K | ₹1L-₹2L (parallel run) |
| Post-migration monitoring + fixes | ₹50K-₹1L | ₹1L-₹2L |
| TOTAL | ₹7L-₹15L | ₹18L-₹35L |
| Timeline | 8-14 weeks | 16-26 weeks |
| 5-year TCO (with maintenance) | ₹14L-₹25L | ₹26L-₹45L |
| Forward runway | 3-4 years (Laravel 11 supported until 2027-2028) | 5-8 years |
Rewrites cost 2-3x migration but give 2x forward runway + modernization benefits. The decision depends on your application's strategic horizon.
What's New in PHP / Migration Landscape in 2026
1. PHP 8.3 LTS Established as Long-Term Standard
PHP 8.3 (released Nov 2023) is supported until Nov 2027. PHP 8.4 released Nov 2024, supported until Dec 2028. We recommend 8.3 LTS for production migrations in 2026 — most Composer packages have full 8.3 support, framework support is mature.
2. PHP 8.0 Now Also EOL (As of Nov 2023)
If you migrated 7.4 → 8.0 in 2023 thinking that's done, you're back in the same situation. PHP 8.0 EOL'd in Nov 2023. Direct migration from 8.0 to 8.3 is much easier than 7.4 to 8.3 — usually 30-40% of the cost.
3. Laravel 11 Released March 2024
Laravel 11 is the new long-term version — minimal application skeleton, simpler routing, improved testing, stronger type system. Migration target for any Laravel app today.
4. WordPress 6.5+ Requires PHP 8.0 Minimum
WordPress core requires PHP 7.4 minimum, but 6.5+ recommends PHP 8.1+. Many premium plugins (WooCommerce, Yoast SEO, Elementor Pro) have dropped 7.4 support in 2024-2025. Stuck on 7.4 = stuck on outdated WordPress = losing security patches and features.
5. AI-Assisted Migration Cut Costs 30-40%
Tools like Cursor, Claude Code, GitHub Copilot accelerate PHP migration significantly. We've cut migration timelines by 30-40% in 2025-2026 — what took 12 weeks in 2023 now takes 7-8 weeks at the same price.
6. DPDP Act Enforcement Started
The DPDP Act (passed Aug 2023) entered enforcement phase in 2025. Data Protection Board of India started accepting complaints in late 2025. We're aware of 8+ enforcement actions in 2025-2026, several involving EOL software. Compliance is no longer theoretical risk.
7. Cyber Insurance Underwriting Tightened
Indian cyber insurance market matured in 2024-2026. Underwriters now require: vulnerability scan results, software version inventory, EOL software disclosure. Premiums for businesses on EOL software 2-3x higher (if coverage available at all).
8. Hosting Auto-Upgrades Forced Migration Wave
Hostinger forced PHP 8.x upgrade to 12M+ shared hosting customers in 2025. Created a wave of "site broken after auto-upgrade" emergency migrations across India. We saw 40+ such inquiries in 2025 alone.
When PHP Migration Wins (vs Rewrite)
Migration is the right call when:
- ✅ Application is on Laravel 8+ already (incremental upgrade vs full rewrite)
- ✅ Team has PHP expertise to maintain post-migration
- ✅ UX is acceptable, doesn't need redesign
- ✅ No major feature additions planned in next 18 months
- ✅ Application sunset planned in 3-5 years
- ✅ Budget under ₹15L for the entire effort
- ✅ Internal use / B2B back-office (not customer-facing)
When Rewrite Wins
Rewrite is the right call when:
- ✅ Application on dead framework (CodeIgniter 3, Yii 1.x, custom procedural PHP)
- ✅ UX dated and needs redesign anyway
- ✅ Hiring PHP talent is hard for your business
- ✅ Major feature additions planned (mobile apps, AI, real-time)
- ✅ Customer-facing application where Core Web Vitals matter
- ✅ Application has 5+ year strategic horizon
- ✅ Modernization unlocks new revenue (mobile apps, API marketplace)
Real Indian Business Migration Stories
Story 1: Mumbai Fintech — Migrated Just Before DPDP Enforcement
Indian fintech startup with PHP 7.4 + Laravel 6 application processing 50K transactions/day. CTO knew they should migrate but kept deferring. We pitched migration in early 2025, they finally engaged in mid-2025.
We migrated to Laravel 11 + PHP 8.3 in 11 weeks for ₹9.5L. Three months after migration completed, DPDP Act enforcement started, and a peer fintech (still on PHP 7.4) got their first DPDP notice. Our client cited their migration in their compliance audit and passed cleanly.
Story 2: Lucknow E-commerce — Hostinger Auto-Upgrade Disaster
Mid-size Lucknow ecommerce platform on PHP 7.4 + WooCommerce. Hostinger force-upgraded their server to PHP 8.1 with 30 days notice. Owner ignored the notice. Site broke at 6 AM during Diwali sale. ₹4L lost in 8 hours of downtime before they reached us.
We did emergency migration in 5 days for ₹3.2L (premium for emergency turnaround). Lesson: don't ignore PHP upgrade notices from hosting providers.
Story 3: Bengaluru SaaS — Rewrote PHP to Next.js, Tripled Conversion
Bengaluru SaaS on PHP 5.6 (yes, 2015 EOL!) + custom procedural code. Owner kept deferring migration "until next year" for 5 years. Conversion rate was 1.2% on landing pages, mobile experience terrible.
We rewrote to Next.js + Node.js + Postgres in 22 weeks for ₹26L. Post-launch metrics:
- Page load time dropped from 4.8s to 0.9s (Core Web Vitals all green)
- Mobile conversion rate jumped from 0.4% to 2.1% (5x lift)
- Total signups +180% YoY
- Hiring time for engineers dropped from 8-12 weeks (PHP) to 3-4 weeks (Next.js)
The ₹26L rewrite paid back in 11 months from increased conversion alone.
How Codingclave Handles PHP 7.4 EOL Migrations
We've completed 28 PHP version migrations and 14 PHP-to-modern-stack rewrites since 2020. Our delivery framework:
| Phase | What Happens | Timeline |
|---|---|---|
| 1. Audit | Codebase analysis, dependency map, migration vs rewrite recommendation | 1 week |
| 2. Plan | Detailed scope, risk register, parallel-run strategy if rewriting | 1 week |
| 3. Build | Migration or rewrite execution + automated tests | 5-22 weeks |
| 4. Test | UAT, regression, security scan, performance benchmark | 1-3 weeks |
| 5. Deploy | Phased deployment, parallel run, cutover, monitoring | 1-2 weeks |
| 6. Stabilize | Post-deployment fixes, performance tuning, training | 2-4 weeks |
Every migration includes: full test suite, deployment runbook, monitoring setup (Sentry + UptimeRobot), DPDP/PCI compliance checklist, code documentation handover, 30-day post-launch support.
Get Off PHP 7.4 Before It Costs You More
If your business is still on PHP 7.4 (or 8.0/8.1 also EOL), every day of delay increases breach risk + DPDP exposure. WhatsApp me your codebase details (framework, size, hosting) and I'll send you a free migration vs rewrite recommendation within 24 hours.
WhatsApp Ashish for free PHP migration audit →
Or schedule a 30-minute call →
About the Author
Ashish Sharma is the founder of Codingclave, a Top Rated Upwork agency that has completed 28 PHP migrations and 14 PHP-to-Node.js/Next.js rewrites since 2020. He works with Indian businesses to plan migration vs rewrite decisions based on application complexity and strategic horizon. Reach him on LinkedIn, Upwork, or WhatsApp.
Related reading:
Frequently asked questions
No — PHP 7.4 reached end of life on November 28, 2022. As of 2026, it has not received security patches for 3+ years. Known unpatched CVEs include CVE-2023-3823 (XML external entity), CVE-2023-3824 (PHAR deserialization), CVE-2024-1874 (proc_open command injection), and CVE-2024-5458 (filter_var bypass). Any business running PHP 7.4 in production is one zero-day away from data breach. Indian businesses on PHP 7.4 in 2026 have failed multiple PCI DSS, ISO 27001, and DPDP Act audits we've seen. The fines from a single DPDP Act breach can hit ₹250 Cr (per the 2023 Act). Migration is not optional — it's overdue.
Real cost depends on application complexity and codebase size. Small business website (WordPress + 5-10 plugins, <50K LOC custom code): ₹2L-₹4L (3-6 weeks). Mid-size custom PHP application (Laravel 6/7, custom CRM, 50K-200K LOC): ₹6L-₹15L (8-14 weeks). Enterprise PHP application (legacy CodeIgniter or custom MVC, 200K-1M LOC): ₹15L-₹50L (16-30 weeks). Migration includes: PHP version upgrade, deprecated function replacements, dependency upgrades (Composer packages), database compatibility (PDO changes), session handling fixes, regression testing, deployment, post-migration monitoring.
Three-factor decision. Migrate to PHP 8.3 if: (1) Application is on Laravel and well-architected (Laravel 9+ has clean migration path); (2) Team has PHP expertise to maintain; (3) Application works fine functionally — just needs version safety. Rewrite to Node.js/Next.js if: (1) Application is on dead frameworks (CodeIgniter 3, Yii 1.x, custom procedural PHP); (2) UI is dated and needs full redesign; (3) Need modern features (real-time, AI, mobile apps, JAMstack performance); (4) Hiring PHP talent is hard for your business; (5) Planning major feature additions that would require significant restructure anyway. Rewrites cost 2-4x migration but give 5-8 years of forward runway.
Six concrete risks Indian businesses face running PHP 7.4 in production: (1) Unpatched RCE vulnerabilities — attackers execute arbitrary code on your server; (2) DPDP Act violations — running unsupported software with personal data is failure of 'reasonable security safeguards' clause; (3) PCI DSS audit failure — payment processing on EOL software fails compliance; (4) Insurance denial — cyber insurance increasingly excludes coverage for breaches on EOL software; (5) Hosting provider termination — Hostinger, Bluehost, Hetzner, AWS Lightsail are auto-disabling PHP 7.4 sites in 2025-2026; (6) Plugin/dependency abandonment — major Composer packages dropping PHP 7.4 support means you can't get security updates for libraries either.
Realistic timelines based on application complexity. Small WordPress site (basic theme + 10 plugins): 1-2 weeks. WordPress with custom theme + 30+ plugins + WooCommerce + custom development: 3-6 weeks. Custom Laravel 6/7 application (50K LOC): 5-9 weeks. Custom Laravel 5 / CodeIgniter 3 application: 8-16 weeks (often easier to rewrite parts than migrate). Enterprise PHP monolith (200K+ LOC, multiple integrations): 16-30 weeks. Rewrites to Node.js/Next.js take 2-3x longer than migration but produce modern codebase. We've completed 28 PHP migrations + 14 rewrites since 2020.
Almost never. PHP 7.4 to 8.0 alone introduced 80+ deprecated functions that became fatal errors. PHP 7.4 to 8.3 (3 major versions skipped) introduces ~250 breaking changes. Direct version flip on production = guaranteed downtime. Common breakages: removed functions (each() since 8.0, money_format() since 7.4 itself, mysql_* since 7.0), changed function signatures, stricter type juggling, removed magic quotes residuals, deprecated features in libraries (Intl, OpenSSL, JsonSerializable), Composer dependency conflicts (most packages dropped 7.4 support), session handling changes. We've never seen a PHP 7.4 codebase upgrade to 8.3 with zero code changes — even simple WordPress sites need 50-200 fixes.
Laravel framework version migration is the bigger work for Laravel apps. Laravel 6 to Laravel 11 spans 5 major versions with significant API changes: route file structure (separate web.php/api.php since 6, restructured in 11), Eloquent model changes, queue + job changes, mail facade changes, blade syntax updates, container/service provider changes, removed deprecated artisan commands, environment file restructure. Cost split: PHP version upgrade alone ₹2L-₹6L; full Laravel framework migration ₹4L-₹15L; combined PHP + Laravel migration ₹5L-₹20L. We strongly recommend doing both together — half the QA effort.
Yes for 60-70% of legacy PHP applications. Five reasons rewrites win: (1) Modern UX — React Server Components + Tailwind ship far more polished interfaces than legacy PHP+jQuery+Bootstrap; (2) Performance — Next.js apps 2-5x faster Core Web Vitals than equivalent PHP; (3) Hiring — Next.js/Node.js talent pool 3x larger and growing in India 2026; (4) AI features — Node.js native ecosystem for [OpenAI](/integrations/openai-integration), [Claude](/integrations/claude-integration), vector DBs vs PHP afterthought support; (5) 5-year forward runway — Next.js architecture stays current 5+ years vs another PHP migration in 2-3 years. The 30-40% of cases where PHP migration wins: well-architected Laravel monoliths used internally where modern UX doesn't matter, applications planned for sunset within 24 months.