QiYuan Labs
PHP 8.2 security support ends December 31, 2026

Your old PHP app still works. The PHP version under it is running out of time.

I upgrade small-business PHP systems and WordPress/WooCommerce plugins to PHP 8.4 for a fixed price. Then I prove the upgrade works by clicking through your actual app, page by page, before and after. A scanner report alone doesn't do that.

Book a $300 Upgrade Check-up See pricing

Fixed prices. Work happens on a copy of your system, never on your live site.

Why now

Each PHP version gets two years of bug fixes, then two years of security fixes only, then nothing. After that date, newly found security holes in PHP itself stay open on your server, and hosting providers eventually stop offering the old version.

PHP versionBug fixes untilSecurity fixes until
7.x, 8.0, 8.1EndedEnded
8.2EndedDec 31, 2026
8.3Ended Dec 31, 2025Dec 31, 2027
8.4 (my default)Dec 31, 2026Dec 31, 2028
8.5Dec 31, 2027Dec 31, 2029

Source: php.net, Supported Versions page, checked October 30, 2026.

Scanners miss the failures that take sites down

Most upgrade services run automated tools (PHPCompatibility, Rector) and fix what they report. I run them too. But on three practice upgrades of real open-source PHP projects, most of the failures that actually broke a page or a feature were invisible to those tools. They only showed up when the app was running.

5 of 7

serious failures were found only by running the app, not by static scanning.

0

issues reported by the scanner on one project, which still had a feature that silently stopped working.

18 / 19

admin requests returned a server error on a WooCommerce plugin that "activated fine."

What brokeProjectFound by
Fatal errors in bundled libraries (email, profiler)Booking appScanner
Warnings printed before headers, which broke logins and the whole admin areaBooking appRuntime only
CAPTCHA image fails to render (TypeError in a bundled library)Booking appRuntime only
API search returns a server error (TypeError)Booking appRuntime only
"Delete avatar" silently fails, no error shownMembership appRuntime only
Entire WordPress admin returns a server errorWooCommerce pluginScanner, but only when the plugin's bundled code is scanned too
Product pages return a server error (TypeError on empty weight)WooCommerce pluginRuntime only

What a runtime smoke test means here

I get your system running on a private copy, turn PHP error reporting all the way up, and walk through the flows your business depends on: logging in, booking, checking out, sending email, the admin screens, the API. I record every error before the upgrade and again after it. You get both lists. The goal after the upgrade is zero PHP errors on every tested flow.

Three practice upgrades, before and after

These are upgrades I did on public open-source projects to test my process. They are not client projects, and the original authors were not involved. These runs targeted PHP 8.3; new projects default to PHP 8.4.

Online booking system

Easy!Appointments 1.3.2 · CodeIgniter 3 · about 20,000 lines plus a bundled framework and libraries

Before289 distinct PHP errors in one click-through. Sessions broke, the admin area wouldn't load, CAPTCHA and API search failed.
After0 PHP errors in development and production mode. Booking, email with calendar invite, admin and full REST API all pass.

Fix: upgraded the bundled framework and three libraries, patched framework classes for PHP 8.2+ rules, fixed two runtime bugs by hand, moved the test suite to PHPUnit 9 (30 tests pass).

Flagged separately: the old Google Calendar SDK should be replaced. That is quoted as its own job.

Membership and login system

panique/huge · custom MVC · about 5,100 lines · MIT license

BeforeScanner: 0 issues. Reality: "delete avatar" silently failed, 13 deprecation warnings, tests couldn't run on PHP 8.
After0 PHP errors across login, remember-me, registration, password reset, avatars, notes and admin. 27 tests pass.

Cause: since PHP 8.1 the database driver returns numbers as integers, and a validation check quietly rejected them. Also fixed a deployment bug where required libraries were listed as dev-only.

WooCommerce multilingual plugin

WooCommerce Polylang Integration 1.0.4 · about 9,500 lines · MIT license

BeforePlugin activated without complaint, then 18 of 19 admin requests and the product pages returned server errors.
AfterEvery tested admin and shop page loads. 0 PHP errors from the plugin. A French order went through end to end.

Fix: replaced a removed PHP function in bundled code, and stopped empty product weights from crashing the number formatter.

Flagged separately: cross-language stock sync fails with WooCommerce's newer order storage (HPOS). That is a WooCommerce change, not a PHP one, so it is quoted as its own job.

How it works

  1. Upgrade Check-up ($300, 5 days). You give me a working copy of your system. I scan it, run it on PHP 8.4 and click through your key flows. You get a list of what breaks and a fixed-price quote. If you order the upgrade within 30 days, the full $300 is credited toward it.
  2. Fixed-price upgrade. If you go ahead, I upgrade the copy: dependencies first, then your code. No surprise invoices; anything outside the agreed scope is quoted before I touch it.
  3. Before-and-after proof. The same smoke test runs again. You get the error lists side by side, the code changes, and notes on anything I couldn't test.
  4. A deployment and rollback plan. You or your host deploy using my step-by-step plan, with a fresh backup taken first. If you'd like me to handle the go-live, that's quoted separately.
  5. 14 days of free fixes. If something in the tested flows breaks because of the upgrade within 14 days of delivery, I fix it at no charge.

Why I upgrade to PHP 8.4, not 8.3

One more year for the same job

PHP 8.3 already stopped getting bug fixes at the end of 2025, and its security fixes end December 31, 2027. PHP 8.4 is covered until December 31, 2028.

Little extra work

For old code, most breaking changes sit between PHP 7 and 8.3. PHP 8.4 adds some deprecations and moves a few rarely used extensions (such as IMAP) out of core, and the Check-up looks for those. When I ran the PHP 8.4 checks on two of my practice projects, they found nothing new that needed fixing.

8.5 on request

If your host and all your plugins already support PHP 8.5, I can target it instead. The Check-up tells you whether that's realistic.

Pricing

Upgrade Check-up

$300

One-time · 5-day delivery

  • Static scan, including bundled libraries
  • Dynamic property check (PHP 8.2+)
  • One runtime smoke test of your key flows
  • Written issue list and fixed-price upgrade quote
  • Full $300 credited if you order the upgrade within 30 days

Requires a working copy you provide: a staging site, or your code plus a database export that runs. No working copy? Add environment setup for $150 (adds 3 days).

Book the Check-up

Small app or plugin

$2,000

Fixed price · 10-day delivery

  • One custom PHP app or one WordPress or WooCommerce plugin
  • Up to about 10,000 lines with few dependencies
  • Upgrade to PHP 8.4, dependency updates included
  • Before-and-after smoke test report
  • Deployment and rollback plan
  • 14 days of free fixes on tested flows

Bigger systems get a fixed quote after the Check-up.

Start with a Check-up

Framework app

$3,500

Fixed price · 21-day delivery

  • A CodeIgniter 3 or custom MVC app, up to about 15,000 lines
  • Bundled framework and up to 3 bundled libraries upgraded first
  • Upgrade to PHP 8.4, existing test suite moved to PHPUnit 9 if there is one
  • Before-and-after smoke test report
  • Deployment and rollback plan
  • 14 days of free fixes on tested flows

Larger apps (older Laravel, Zend, more libraries) get a fixed quote after the Check-up.

Start with a Check-up

Maintenance

$200

Per month · cancel any time

  • Monthly security update check for PHP and your dependencies
  • Smoke test re-run after your host changes PHP versions
  • Up to 2 hours of small fixes per month (unused hours don't roll over)
Ask about it

Add-ons

  • Environment setup when you don't have a working copy: $150, adds 3 days
  • Extra revision round: $150, adds 2 days

Delivery times count from the day I receive your working copy and answers to the intake questions.

Quoted separately

These often come up during a PHP upgrade but are separate jobs, so they never hide inside a fixed price:

  • Adapting to new versions of the platform itself, such as new WordPress or WooCommerce APIs (for example WooCommerce's HPOS order storage)
  • Replacing abandoned third-party SDKs (for example an old Google API client)
  • Writing new automated tests
  • Hands-on deployment and go-live support

Questions

Do you need access to my live site?

No. All work happens on a copy, and by default I don't deploy, so I never need production access.

Will you deploy the upgrade to my server?

Not by default. You get the upgraded code and a step-by-step deployment and rollback plan for you or your host. If you'd like me to handle the go-live, I'll quote it separately, and I'll only touch production with your written go-ahead and a fresh backup.

What happens if something breaks after delivery?

For 14 days after delivery, I fix at no charge any problem in the tested flows that the upgrade caused. Problems from later changes (plugin updates, hosting changes) or in flows we didn't test are quoted separately.

What if I don't have a staging site?

Send the code and a database export. If it doesn't run as-is, environment setup is a $150 add-on that adds 3 days. For plugins, I need to know your WordPress, WooCommerce and plugin versions.

Is the $300 Check-up credited toward the upgrade?

Yes. If you order the upgrade within 30 days of receiving the Check-up report, the full $300 comes off the upgrade price.

My database has customer data. How do you handle it?

Where possible, send a copy with personal data removed or replaced. Any copy I receive stays private and is deleted when the project ends. If your system holds health or payment card data, tell me before sending anything so we can agree on a safe approach.

Will the upgrade catch every bug?

No one can promise that. The smoke test covers the flows we agree on in the Check-up. I list what was tested and what wasn't, so you know exactly where the coverage stops.

Do you use AI or automated tools?

Yes: PHPCompatibility, Rector and my own checkers and test scripts. On my practice projects, automated rewrites covered between none and half of the code changes. The fixes that actually stopped the crashes came from dependency upgrades and hand-written changes, and every one was verified by running the app.

Who are you?

I'm Bo Zeng, a PHP developer with 18 years of experience. I run QiYuan Labs LLC, a US company registered in Wyoming, and work remotely. Email hello@qiyuanlabs.ai with any question before you book.

Find out what breaks before your host decides for you

The Check-up costs $300 and tells you exactly what an upgrade involves and what it will cost.

Book a $300 Upgrade Check-up