Unsupported PHP 5 business app: security risk and exit cost 2026

The verdict in three sentences

An app on PHP 5 (and even PHP 7) runs on a version out of security support: every new flaw found in the language or its extensions stays open forever. The first useful spend is a code audit (3,000 to 8,000 EUR excl. VAT), which tells you whether progressive refactoring (20,000 to 60,000 EUR) is enough or a rewrite (40,000 to 150,000 EUR) is more sensible. Either way, set aside 10 to 20% of the budget for data migration, the most underestimated item.

Why the risk grows every month

PHP 5.6 has had no security fixes since 31 December 2018, PHP 7.4 since November 2022. In 2026, only the 8.2 branch and later still receive fixes. An app frozen on PHP 5 also forces an old operating system, an old MySQL version and abandoned libraries. The host often ends up charging a surcharge or shutting the service down.

The three exits and their cost

A code audit examines structure, functional coverage, data model quality and obvious flaws. It produces a costed recommendation. Depending on the result, three paths open up.

For reference, Kolonell's 2026 grid for a custom app ranges from 2,500,000 to 4,000,000 FCFA (3,810 to 6,100 EUR) for a simple app, 4 M to 7 M FCFA (6,100 to 10,670 EUR) for a medium app and 7 M to 15 M+ FCFA (10,670 to 22,870+ EUR) for a complex app. The ranges in the table reflect prices observed at French agencies.

Data migration, an item not to underestimate

Twelve years of data in an old MySQL database almost always contain mixed encodings (latin1 and UTF-8), duplicates, fields repurposed for other uses and missing constraints. This work represents 10 to 20% of the total budget and determines user acceptance.

Mini case study

Illustrative scenario: Thierry, operations director of a 70-employee transport SME in Lille, depends on a PHP 5 route management app written 12 years ago. His host charges him 180 EUR per month for extended support and every small change costs about 1,200 EUR from a freelancer who has to rediscover the code. He orders an audit at 5,000 EUR excl. VAT: verdict, sound business logic but unstructured code. He chooses progressive refactoring at 42,000 EUR, including 6,000 EUR of data migration, spread over 7 months. Expected savings: 2,160 EUR a year of special hosting and about 8 changes a year billed 400 EUR instead of 1,200 EUR, i.e. 6,400 EUR. The direct gain is about 8,500 EUR a year, but the decisive argument remains removing the risk of a customer data breach.

FAQ

Is a PHP 5 app necessarily vulnerable?

It runs on a language with no fixes since late 2018, so any flaw discovered since then stays open. Legacy code also often uses unprepared SQL queries, a frequent cause of injections.

How much does a legacy code audit cost?

Between 3,000 and 8,000 EUR excl. VAT depending on app size, for 3 to 8 days of work. It produces a costed recommendation between upgrade, refactoring and rewrite.

Do we have to rewrite everything?

Not necessarily. If the business logic is sound, progressive refactoring at 20,000 to 60,000 EUR keeps the existing app while modernising it. A rewrite, at 40,000 to 150,000 EUR, is justified when the code is unreadable or needs have changed.

How long does leaving PHP 5 take?

1 to 3 months for a simple upgrade, 4 to 9 months for refactoring and 6 to 12 months for a full rewrite. The final cutover usually fits into a weekend.

Can the existing app be secured temporarily?

Yes, by isolating the server, adding a web application firewall and restricting access via VPN, for 2,000 to 6,000 EUR. It is a 6 to 12 month stopgap, not an exit.

Let's scope your project. Describe your app, its size and its users: we will propose an audit, an indicative refactoring or rewrite budget and a 3 to 12 month plan. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.