The verdict in three sentences
A PHP 5 application has received no security patches since 2018: every month of waiting raises the breach risk and the cost of the eventual rebuild. A full rewrite at EUR 60,000 to 180,000 (about CAD 90,000 to 270,000) looks attractive on paper, but it fails or overruns in a significant share of cases, because nobody can write accurate specifications for 12-year-old software. A progressive module-by-module migration is 20 to 40% less risky and delivers value from month three.
What technical debt already costs you
The question is not whether modernization is expensive, but whether it costs more than standing still. Here are typical items for a 80 to 200 employee company with an annual IT budget of EUR 250,000.
| Annual legacy-related item | 2026 order of magnitude | Comment |
|---|---|---|
| Corrective maintenance | EUR 18,000 to 35,000 | Every fix touches untested code |
| Dedicated PHP 5 hosting | EUR 4,000 to 12,000 | Obsolete servers, paid extended support |
| Extra cost of new features | +40 to 80% per feature | No tests, tight coupling |
| Dependence on 1 or 2 key people | Unquantified but critical | Retirement or resignation |
| Unpatched security flaws | Average incident: EUR 50,000 to 300,000 | Libraries unpatched since 2018 |
| Total technical debt | 15 to 25% of IT budget, i.e. EUR 37,500 to 62,500 | Excluding security incidents |
At EUR 50,000 per year, the debt pays for a EUR 120,000 progressive migration in just over two years, before even counting the lower incident risk.
Full rewrite or progressive migration
Two strategies dominate. The choice depends on application size, documentation quality and your risk tolerance.
| Criterion | Full rewrite | Progressive module migration | In-place upgrade (PHP 8) |
|---|---|---|---|
| 2026 cost | EUR 60,000 to 180,000 | EUR 70,000 to 200,000, spread out | EUR 25,000 to 60,000 |
| Duration | 8 to 18 months | 12 to 24 months, in 2 to 3 month phases | 3 to 6 months |
| First value delivered | At final cutover | From the first module, month 3 | Month 2 to 3 |
| Overrun risk | High: +30 to 50% common | Moderate: 20 to 40% less risky | Low to moderate |
| Service interruption | Single risky cutover | None, both systems coexist | Short, testable |
| Residual debt | Low | Low over time | Medium: architecture stays |
| Best for | Small app, simple rules | Core business app, 50,000+ lines | Decent code on an obsolete version |
Progressive migration follows the strangler pattern: a new application, in recent Laravel or Symfony or another modern stack, takes over modules one by one while the old code keeps serving the rest.
The five-step migration plan
- 2 to 4 week audit (EUR 6,000 to 15,000): map modules, dependencies, vulnerabilities, data volumes and business rules hidden in the code.
- Technical foundation: shared authentication, shared or synchronized database, regression tests on critical screens.
- First high-value module, often invoicing or the customer portal, delivered in 8 to 12 weeks.
- Following phases of 2 to 3 months, each put into production and validated by users.
- Decommissioning of the old PHP 5 server, which removes dedicated hosting costs.
Mini case study
Nicolas, IT director of a 120-employee building materials distributor in Toronto, depends on a 12-year-old PHP 5 application for quotes, inventory and invoicing. His IT budget is EUR 260,000 per year, of which about EUR 52,000 is absorbed by maintenance, obsolete hosting and the extra cost of changes.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
A full rewrite is priced at EUR 150,000 over 14 months. He chooses a progressive migration at EUR 135,000, split into an audit and five phases over 20 months. The quotes module ships in month 4. After decommissioning, the annual cost of debt falls to about EUR 12,000, a saving of EUR 40,000 per year: the investment pays back in just over three years, and the risk tied to 2018-era libraries disappears as soon as the internet-facing module is replaced.
FAQ
Can we simply move from PHP 5 to PHP 8 without rewriting everything?
Yes if the code is reasonably structured: allow EUR 25,000 to 60,000 and 3 to 6 months. If the application mixes SQL, HTML and business logic in the same files, the upgrade often costs 70% of a migration.
How much does a legacy code audit cost?
Between EUR 6,000 and 15,000 for 2 to 4 weeks depending on size. It delivers a map, a prioritized vulnerability list and a per-module estimate with about a 15% margin of error.
How do we avoid losing business rules during the rebuild?
By writing characterization tests on the old system before any change. Budget 10 to 15% of the migration cost: it is the most profitable insurance in the project.
Should we stay on PHP or change language?
PHP 8 with Laravel or Symfony remains a solid choice in 2026 and eases hiring. Changing language adds 10 to 20% in cost and is only justified by a specific need.
What is the legal risk of an unmaintained application?
After a data breach, privacy laws such as PIPEDA in Canada or GDPR in Europe expose the company to sanctions and mandatory notification, and regulators treat missing updates as a security failure. The average incident cost for an SME often exceeds EUR 50,000.
Let's scope your project. Describe your application, its size and critical modules: we propose an audit, a migration strategy and a budget per phase. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
