PHP 7 EOL upgrade to Node.js means moving an application that still runs PHP 7.x onto Node.js with React or Next.js. php.net lists every PHP 7 branch as end of life, the last on November 28, 2022, and for the October 21, 2026 PHP2Shell flaws it offers PHP 7 users only a source-only backport for 7.4. Moving to a supported PHP or re-platforming is the real fix. MIS Services assesses your application, recommends a target, and delivers the migration to Node.js and React. See the hub overview or book a free assessment.
Status as of October 22, 2026, 11:05 AM ET (15:05 UTC)
We re-read each source at the time shown. The story is moving, so check the primary sources for the latest.
- PHP 7: php.net lists every PHP 7 branch as end of life, from 7.0 (January 10, 2019) to 7.4 (November 28, 2022). The last 7.x release is 7.4.33.
- Fixed releases: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, published October 21, 2026 (php.net advisory). The PHP security team also published minimal source-only backports for 7.4, 8.0 and 8.1. None is listed for 7.0 to 7.3.
- **Sophos** (version 4, updated October 22) says all PHP versions before the fixed releases are affected, that the backports come with no binaries, and that systems on those versions should move to a supported branch.
- **CISA says organizations that cannot update immediately, or that still use PHP 8.1 or earlier, should take PHP-based systems offline until patched or updated. The NSA** says to do so if an immediate update is not feasible, and lists replacing end-of-life PHP services among steps to assess.
- Exploitation reports differ: Sophos cites an attempt on October 17, before disclosure. Sansec said on October 22 that mass exploitation is less likely than first expected, because attacks need specific conditions, and that store owners need not go offline, but still says to update PHP.
For this week's steps (inventory, patching, interim settings) use our PHP2Shell fix guide.
Which PHP 7 Versions Are End of Life, and Since When?
PHP 7 EOL means the PHP project has stopped releasing fixes, security fixes included, for the 7.x branches. php.net's unsupported-branches page strongly urges people on these releases to upgrade, because older versions may expose them to vulnerabilities fixed later. The table gives each branch's dates from php.net and the share of PHP 7 sites W3Techs says still runs it.
| Branch | Initial release | End of life | Last release | Share of PHP 7 sites | Source backport for PHP2Shell |
|---|---|---|---|---|---|
| 7.4 | Nov 28, 2019 | Nov 28, 2022 | 7.4.33 (Nov 3, 2022) | 73.4% | Yes, source only |
| 7.3 | Dec 6, 2018 | Dec 6, 2021 | 7.3.33 (Nov 18, 2021) | 10.5% | Not listed |
| 7.2 | Nov 30, 2017 | Nov 30, 2020 | 7.2.34 (Oct 1, 2020) | 8.4% | Not listed |
| 7.1 | Dec 1, 2016 | Dec 1, 2019 | 7.1.33 (Oct 24, 2019) | 3.7% | Not listed |
| 7.0 | Dec 3, 2015 | Jan 10, 2019 | 7.0.33 (Dec 6, 2018) | 4.0% | Not listed |
On scale, W3Techs reports PHP 7 on 18.7% of all websites whose server-side language it knows, against 69.3% for PHP overall (October 22, 2026). Our PHP end-of-life guide covers the supported branches and the policy behind these dates, so this page does not repeat them.
What Does PHP 7 End of Life Mean After PHP2Shell?
End of life does not switch a site off; it ends the flow of upstream fixes. PHP2Shell shows the effect. The PHP announcement names fixed releases for four branches, says PHP 8.1 and older no longer receive updates, and notes that some distributions and long-term-support vendors provide backported fixes. For 7.4 it adds a minimal source-only backport for people who build from source or have no LTS vendor.
So the honest line depends on where you are. On a supported branch, patch now, but patching is step one, not a strategy: php.net ends 8.2 security support on December 31, 2026, and frameworks set their own PHP ceilings, as the next section shows. On PHP 7, PHP.net no longer issues regular fixes and, apart from the 7.4 source backport, nothing for these flaws, so moving to a supported PHP or re-platforming is the real fix.
Sansec says the vulnerable code is present in every unpatched PHP since 5.4, so the whole 7.x family is in range. It also lists third-party packages with the fix backported: free and paid, some tied to specific distribution releases, with the most sources for 7.4. We have not tested any of them. A fixed package keeps its old-looking version number, so ask your vendor which advisory covers your build.
CERT-EU lists end-of-life branches among the affected and says to contact your vendor or upgrade. CISA's wording covers PHP 8.1 or earlier, which includes every PHP 7 release. None of this says your site has been attacked, and we make no claim to detect attacks. Clients have told us that auditors have flagged end-of-life PHP; we make no compliance promises, and what the standards actually say is in our legacy PHP security risk modernization guide. If you suspect compromise, preserve your logs and contact an incident-response provider.
Should You Upgrade PHP 7 or Move to Node.js and React?
Two options are honest: upgrade PHP to a supported branch, or re-platform to Node.js with React. A PHP 7 application is rarely a one-version problem, so measure the gap first. php.net links one migration guide per step, from 7.0 to 7.1 through 7.4 to 8.0 and on. PHP 8.2's security support ends December 31, 2026, so the table counts the guides to 8.3 and 8.4.
| You run | Guides to reach 8.3 | Guides to reach 8.4 | First guide |
|---|---|---|---|
| 7.4 | 4 | 5 | 7.4 to 8.0 |
| 7.3 | 5 | 6 | 7.3 to 7.4 |
| 7.2 | 6 | 7 | 7.2 to 7.3 |
| 7.1 | 7 | 8 | 7.1 to 7.2 |
| 7.0 | 8 | 9 | 7.0 to 7.1 |
What PHP 7 code tends to trip over
| Pattern in PHP 7 code | What php.net says |
|---|---|
| Encryption through mcrypt | The 7.1 guide deprecates it in favor of OpenSSL and moves it out of core into PECL in 7.2. |
| Using __autoload() | Deprecated in the 7.2 guide; the 8.0 guide removes it in favor of spl_autoload_register(). |
| count() on something that cannot be counted | A warning from 7.2 (see the 7.2 changes); a TypeError in 8.0. |
| Undefined constants and unquoted strings | A warning in 7.2 with an error promised for the next major version; an Error exception in 8.0. |
Frameworks usually set the target. Laravel's 8.x support table lists Laravel 8 with PHP 7.3 to 8.1 and security fixes until January 24, 2023, and Laravel 6 and 7 with PHP 7.2 to 8.0. Each has passed its security-fix date. Laravel 8 stops at PHP 8.1 and Laravel 9 requires PHP 8.0.2 or newer (upgrade guide), so reaching a supported PHP means moving the framework too. CodeIgniter 4's own guide calls it a rewrite that is not backward compatible, so a CodeIgniter 3 application is converted, not upgraded, and CodeIgniter 4.7.5 requires PHP 8.2 or newer.
| Your PHP 7 situation | Usually the better first move | Why |
|---|---|---|
| PHP 7.4, current framework, tests that pass | Upgrade PHP | Four guides to 8.3, and your URLs and team skills stay as they are. |
| Laravel 8 or older | Compare a framework-plus-PHP upgrade with an incremental move | Laravel 8 supports PHP only up to 8.1, which is itself end of life, and its security fixes ended January 24, 2023. |
| CodeIgniter 3 | Compare converting to CodeIgniter 4 with moving to Node.js | Both are real conversions, per CodeIgniter's own guide. |
| Custom PHP with no framework and few tests | Inventory first, then move module by module | No framework path exists; behavior must be pinned down either way. |
| PHP 7.0 to 7.2 with abandoned packages | Treat as a migration candidate | Six to eight guides, and packages that cap the PHP version. |
| A team that writes JavaScript or TypeScript | Incremental migration | A business reason justifies it; one advisory does not. |
| WordPress on 7.4 held back by a plugin | Update PHP at the host first | See our WordPress guide. |
Six Ways to Handle PHP 7 End of Life
None of these replaces patching first. The hub page explains how we scope the larger ones.
Vendor-patched build
Some distributions and LTS vendors backport fixes into older PHP 7 builds. Get the advisory in writing; it is a dated bridge.
Upgrade PHP in place
Move to 8.3 or newer using php.net's per-step guides, static analysis and staging tests. Usually the smallest project.
Upgrade framework and PHP together
Laravel 8 stops at PHP 8.1 and CodeIgniter 3 must be converted, so reaching a supported PHP means sizing both jobs together.
Incremental move to Node.js and React
Route by route behind a reverse proxy, with PHP serving whatever has not moved. Fits teams that want JavaScript or TypeScript.
Rebuild a small site
A brochure site or small store can be rebuilt on a published package instead of migrated piece by piece. See website design.
Retire the application
If nobody uses it, switching it off removes the exposure. An inventory often finds one.
What Does a PHP 7 EOL Upgrade to Node.js and React Involve?
Why this target at all? The honest reasons are people and product: a team that writes JavaScript or TypeScript, a React front end, or one language on server and browser, which NestJS's documentation calls the "lingua franca" of the web. We make no speed or memory claims; results depend on architecture.
The table shows where each part of a typical PHP 7 application lands in a Node.js and React build. The tools named are common options, described from their own documentation; we recommend only after reading your code. Our application development page lists what we build on Next.js, React, Node and Postgres.
| In your PHP 7 application | Node.js and React counterpart | What the documentation says |
|---|---|---|
| Routes and controllers | Route handlers in Express, Fastify or NestJS | Express keeps the query string out of the route path, which matters for URLs like product.php?id=12. Fastify validates routes with JSON Schema. NestJS wraps Express or Fastify in a TypeScript architecture. |
| Templates and views | React components, or Next.js pages | React apps are made of components, which are JavaScript functions that return markup. In Next.js, layouts and pages are Server Components by default, rendered on the server. |
| An API for the front end | REST endpoints, or GraphQL where clients need flexible queries | GraphQL is a query language for an API, backed by your existing code and data, and is not tied to a specific database. |
| Sessions and logins | A real session store and tested password hashing | PHP's session.save_handler defaults to files. Express's session middleware warns that its default MemoryStore is not for production and does not scale past a single process. |
| Models and migrations | Prisma or TypeORM on the same MySQL database | Prisma supports MySQL and MariaDB, and its introspection maps existing tables to models. TypeORM lists MySQL among its supported databases. |
| Queues, cron jobs and scheduled tasks | Worker processes and scheduled jobs, re-created one by one | Laravel's documentation lists queues and task scheduling as framework features, so we inventory them. They do not move on their own (our judgment). |
Passwords and sessions
PHP's password_hash with the bcrypt option produces a crypt-compatible hash with the $2y$ identifier, per the php.net manual. The bcrypt package for Node.js says it supports $2a$ and $2b$ prefixes, treats $2y$ as in theory compatible with $2b$, and does not guarantee full compatibility with hashes from other languages. So we test your real hashes on staging before cut-over and plan a fallback for any that fail, and plan how signed-in users move to the new session store.
Database: keep MySQL, map it, validate it
A move to Node.js does not require a new database engine; your data can stay on MySQL even though Postgres is part of the stack we build on. Prisma's introspection is how it is added to an existing project, so the ORM maps the database you have rather than receiving a copy. To check moved data, MySQL's CHECKSUM TABLE reports a checksum of table contents. MySQL says it reads large tables row by row, that the value depends on row format, and that it is not collision-free, so we pair it with row counts and spot checks.
Deployment: containers and health checks
Docker's Node.js guide describes containerizing as packaging an application with its dependencies, configuration and runtime into one portable image. Express's health-check documentation says a process should finish in-flight requests on SIGTERM, and describes Kubernetes liveness and readiness checks. If your hosting uses containers, we can package the service that way; a single server behind a reverse proxy may not need Kubernetes.
A PHP 7 to Node.js Project in Four Steps
Audit the codebase
We inventory routes, templates, models, sessions, queues, cron jobs, Composer packages and PHP extensions in your Laravel, CodeIgniter or custom code, and confirm the real PHP version from the web server.
Design the API
We map routes to REST endpoints, adding GraphQL only where clients need it, on a framework such as Express, Fastify or NestJS. A pilot module comes first.
Build the React front end
Server-rendered pages become React components, with Next.js where content must rank. We check rendered HTML and crawlable links before launch.
Map and validate the database
The MySQL schema is mapped with an ORM such as Prisma or TypeORM, moved data is checked with counts and checksums, and password hashes are tested on staging.
Routes then cut over one at a time behind a reverse proxy, the strangler fig pattern, with redirects and monitoring in place. Our migration approach is built around zero-downtime cutover and data validation, an approach we have followed since 2014; results depend on your application. The hub page explains that stage.
What Drives the Effort of a PHP 7 to Node.js Project?
We found no reliable source for an average duration or cost, so this page states none. These factors decide the size of the job.
| Driver | Tends to be smaller | Tends to be larger | Basis |
|---|---|---|---|
| Framework and version | Current Laravel or CodeIgniter 4 with clean layering | Laravel 8 or older, CodeIgniter 3, or logic buried in templates | Framework documentation; our judgment |
| Business logic and tests | Tests cover the main flows | Behavior lives in people's heads and is checked by hand | Our judgment |
| Logins and sessions | Standard bcrypt hashes, sessions already in an external store | Custom hashing, file-based sessions, single sign-on | php.net, bcrypt README, Express |
| Background work | Few or no cron jobs and queues | Many scheduled jobs and queue workers with side effects | Laravel documentation; our judgment |
| Public URLs | A few pages with clean URLs | Thousands of indexed URLs, query-string URLs and .php paths needing a redirect map | Google Search Central; Express |
| Database | Clean schema, modest size | Large tables, odd encodings, no foreign keys | MySQL documentation; our judgment |
Search visibility is part of the effort. Google's site-move guide says to map old URLs to new ones, recommends server-side permanent redirects such as 301 or 308, says they do not cause a loss in PageRank, and tells you to expect temporary ranking fluctuation, a few weeks or more for medium-sized sites. Its JavaScript SEO basics call server-side or pre-rendering still a great idea, so we default to server-rendered pages for content that must rank. MIS Services has been an SEO agency since 2014 and has worked with 375 clients; our own site is hand-coded in Next.js. See our search engine optimization work. Results vary, and rankings cannot be promised.
Does Moving to Node.js End the Patching Cycle?
No. The Node.js releases page we read on October 22, 2026 lists Node.js 24 and 22 as LTS, 26 as Current, and 20, first released April 17, 2023, as end of life. It says production applications should use only Active LTS or Maintenance LTS releases. php.net lists PHP 8.2, first released December 8, 2022, with security support until December 31, 2026. The point is not which lasts longer; any runtime needs a planned upgrade routine.
Packages around the runtime need patches too: the Express site carried a notice on October 22, 2026 of September 2026 security releases for several middleware packages. Our security-driven migration guide compares what a new stack does and does not change.
When not to move a PHP 7 application
- The code is healthy and the gap is a few guides; upgrading PHP is the smaller project.
- Nobody on your team can maintain JavaScript or TypeScript, and you have no plan to hire.
- The only reason is a speed claim. We quote none; PHP vs Node.js explains why benchmarks need context.
- There is no test coverage and no owner who can define correct behavior.
What Do We Need From You, and What Do We Deliver?
The offer is a free 30-minute PHP architecture and migration assessment. It leads to a written inventory and a recommendation: upgrade PHP, migrate incrementally, or rebuild. If you proceed, testing and hardening of the new application are part of delivery. We state no durations or team sizes, because they depend on your application.
- The PHP version your web server actually runs (from a live request or hosting panel, not only the command line) and any vendor patch notice.
- Your composer.json and composer.lock, or a package list, with the framework name and version.
- The PHP extensions in use, such as mcrypt, plus your cron entries and queue workers.
- Database type, rough size and the format of stored password hashes.
- Your public URLs or sitemap, and access to Google Search Console and Google Analytics 4.
- Business-critical flows, compliance duties and a named decision-maker.
What we deliver: we assess your application, recommend a target (Node.js with React, or a supported-PHP upgrade when that is the honest answer) and deliver the migration to Node.js and React or to Java Spring Boot. Other stacks can be assessed. We also offer security audits and penetration testing of PHP applications and of the migrated build. Incident response and malware cleanup are separate specialties that this page does not offer. For PCI DSS, HIPAA or ISO questions, read our legacy PHP security guide and talk to your assessor. Weighing Java instead? See PHP 8.1 to Java Spring Boot.
Where the Facts on This Page Come From
Every fact here comes from a page we opened and read on October 22, 2026. Government, PHP project and advisory sources come first; read them for updates.
- php.net: Unsupported Branches php.net/eol.php — end-of-life dates, last releases
- php.net: PHP 7 ChangeLog php.net/ChangeLog-7.php
- php.net: Supported Versions php.net/supported-versions.php
- php.net security advisory, Oct. 21, 2026 php.net/archive/2026.php#2026-10-21-5
- CISA alert, Oct. 21, 2026 cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-re
- NSA press release, Oct. 21, 2026 nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Articl
- CERT-EU advisory 2026-018, v1.1 cert.europa.eu/publications/security-advisories/2026-018/
- Sophos advisory, version 4 sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell
- Sansec: PHP2Shell sansec.io/research/php2shell — PHP 5.4 origin, update
- W3Techs: PHP version 7 w3techs.com/technologies/details/pl-php/7
- php.net: migrating to 7.1, deprecated php.net/manual/en/migration71.deprecated.php
- php.net: migrating to 7.2, deprecated php.net/manual/en/migration72.deprecated.php
- php.net: migrating to 7.2, incompatible php.net/manual/en/migration72.incompatible.php
- php.net: migrating to 8.0, incompatible php.net/manual/en/migration80.incompatible.php
- php.net: password_hash php.net/manual/en/function.password-hash.php
- php.net: session configuration php.net/manual/en/session.configuration.php
- Laravel 8.x release notes laravel.com/docs/8.x/releases
- Laravel 9.x upgrade guide laravel.com/docs/9.x/upgrade
- Laravel 13.x release notes laravel.com/docs/13.x/releases
- CodeIgniter 4: upgrading from 3.x codeigniter4.github.io/userguide/installation/upgrade_4xx.html
- CodeIgniter 4: server requirements codeigniter4.github.io/userguide/intro/requirements.html
- Express: home expressjs.com/
- Express: routing expressjs.com/en/guide/routing.html
- Express: session middleware expressjs.com/en/resources/middleware/session.html
- Express: health checks and graceful shutdown expressjs.com/en/advanced/healthcheck-graceful-shutdown.html
- Fastify fastify.dev/
- NestJS documentation docs.nestjs.com/
- GraphQL: introduction graphql.org/learn/introduction/
- React: quick start react.dev/learn
- Next.js: Server and Client Components nextjs.org/docs/app/getting-started/server-and-client-components
- Prisma: introspection prisma.io/docs/orm/prisma-schema/introspection
- Prisma: MySQL connector prisma.io/docs/orm/v7/core-concepts/supported-databases/mysql
- TypeORM typeorm.io/
- MySQL 8.4: CHECKSUM TABLE dev.mysql.com/doc/refman/8.4/en/checksum-table.html
- bcrypt for Node.js: README github.com/kelektiv/node.bcrypt.js
- Docker: Node.js guide docs.docker.com/guides/nodejs/
- Node.js releases nodejs.org/en/about/previous-releases
- Google: site moves with URL changes developers.google.com/search/docs/crawling-indexing/site-move-with-url
- Google: JavaScript SEO basics developers.google.com/search/docs/crawling-indexing/javascript/javascr
Frequently Asked Questions
Get a Free PHP Architecture and Migration Assessment
Book 30 minutes with our team. Tell us your PHP 7 version and framework, and we will say in writing whether to upgrade PHP, migrate step by step to Node.js and React, or rebuild.
12 W Sunrise HWY, Lindenhurst, NY 11757 · Mon–Fri 9 AM – 6 PM ET
Talk to Us About Your PHP 7 Application
Tell us which PHP version, framework and host you use. We reply on business days, Mon-Fri 9 AM-6 PM ET.