A legacy PHP system looks cheap because it's already paid for. The real costs show up elsewhere: extended-support licences, emergency fixes, forced upgrades and, at worst, a breach that IBM's 2026 report puts at USD 4.99 million on average globally and USD 8 million in the Middle East.
"It works, and it's already paid for." That sentence keeps more legacy PHP systems in production than any technical argument. The application was built years ago, the invoice was settled long ago, and the hosting bill is small. On a spreadsheet, keeping it looks almost free.
It isn't. The costs of an ageing PHP system don't appear as a line item called "legacy PHP". They appear as an extended-support licence, a weekend of emergency work, a forced upgrade that breaks the checkout, a feature that takes far longer than it should and, at the far end, a data breach. This Article looks at where that money goes, using only published figures. Where nobody publishes a number, we say so rather than inventing one.
Why "already paid for" is not the same as "free"
Software ages differently from most business assets. A delivery van wears out visibly, and everyone budgets for its replacement. Software keeps working, but the world around it keeps moving: new security flaws are discovered, the language it runs on releases new versions, and old versions stop receiving fixes.
PHP versions are supported for a fixed period. According to php.net, PHP 7.4 reached end of life on 28 November 2022, PHP 8.0 on 26 November 2023 and PHP 8.1 on 31 December 2025. PHP 8.2 follows on 31 December 2026. After that point, the PHP project no longer fixes newly discovered flaws in a version, and any further protection has to be bought or built.
That is when the hidden costs begin. They fall into four broad groups.
Paying to stay where you are. Commercial providers such as TuxCare, cPanel and Zend offer extended support for old PHP versions. None of them publishes a list price in the documentation we checked, so we won't guess one. What is certain is the shape of the cost: it recurs, it grows with the number of servers or applications, and it buys time rather than a way out. You keep paying for as long as the application can't move.
Emergency work. When a serious flaw is announced, a supported system usually gets a routine update. An unsupported one gets a scramble, often at short notice, outside normal hours and sometimes with outside help. No study we found prices this reliably, but anyone who has lived through one knows it isn't cheap.
Upgrades you didn't schedule. Managed hosting providers increasingly remove old PHP versions on their own timetable. WP Engine's PHP guide states that "Automatic PHP upgrades cannot be deferred." For an application that breaks on newer PHP, a planned project becomes an outage, and the cost includes any revenue lost while the site is down.
Everything you can't build. This cost never appears on an invoice. Old systems limit which payment gateways, login methods and integrations a business can use. Developers spend their time working around the system rather than improving it, and every change carries more risk because nobody is sure what else it affects.
What could go wrong for your business
The largest potential cost is a security breach. Two major annual studies published this year show the scale.
IBM's Cost of a Data Breach Report 2026, based on breaches at 602 organisations, puts the global average cost of a data breach at USD 4.99 million, which IBM describes as a 12% increase on last year and a record high. Closer to home:
- Middle East: IBM puts the average at USD 8 million. Lost business was the largest component at USD 3.57 million per breach, followed by the response after the breach (USD 2.17 million), detection and escalation (USD 1.9 million) and notifying affected people (USD 0.36 million).
- India: IBM reports an average of INR 25.5 crore, up 15.9% from INR 22 crore in 2025.
These are averages across all kinds of organisations and systems, not a prediction for any one business. But the breakdown is telling: the biggest single cost is lost business, the customers and revenue that disappear when trust is damaged.
Beyond a breach, the realistic risks include downtime when an upgrade is forced, slower delivery of new features, and growing dependence on the few people who still understand the old system.
Could your website be next?
The cost of an ageing system doesn't depend on whether anything has gone wrong yet. Licences, workarounds and lost opportunities accumulate quietly, year after year. A system with no incidents can still be expensive.
The breach risk has a specific connection to old software. Verizon's 2026 Data Breach Investigations Report says 31% of breaches "now start with software vulnerabilities, beating stolen passwords as the top way attackers get in". It also reports that 48% of breaches involve ransomware.
Attackers often find vulnerable systems using automated tools that scan large numbers of websites for known weaknesses. They don't need to know your company's name, and a small or low-profile site is not automatically overlooked. The US cybersecurity agency CISA keeps a catalogue of flaws that attackers are known to use, and as of its 21 October 2026 release, it includes PHP flaws such as CVE-2019-11043, which is marked as used in ransomware campaigns. These flaws were fixed years ago on supported versions. They remain useful to attackers because unpatched systems are still online.
That doesn't mean every older system will be breached, or that yours has been. It means running software that no longer receives security fixes places you in the group most exposed to the most common way in.
Why legacy PHP applications deserve attention
Every one of the costs above grows with time. A version that is two years past end of life has two years of unfixed flaws. An application that has skipped several upgrades has several sets of changes to work through, not one. The longer a system stays put, the more expensive both staying and leaving become.
IBM's 2026 Middle East findings add a detail that should concern anyone running older systems: "mismanaged secrets and keys" was named first among the leading factors that increased breach costs in the region. Long-lived passwords, shared keys and credentials left in files on a server are common in applications nobody has revisited in years.
It is worth being fair here. Breaches happen on every technology, including Node.js, and neither the IBM nor the Verizon report breaks costs down by programming language. Well-maintained PHP is not the problem. The concern is software that has fallen behind.
IBM's report also shows the other side: organisations that made extensive use of security AI and automation saved USD 1.93 million on average compared with those that used none. That kind of modern tooling is much easier to adopt on a current system than on one held together with workarounds.
What this means for your organisation
The useful question is not "is our system old?" but "what is it costing us to keep, and what would it cost if it failed?" That means knowing:
- Which PHP applications you run, and who owns each one.
- Which of them are on versions that no longer receive security fixes.
- What you already spend to keep them running, including licences, contractor time, hosting add-ons and the hours your team spends on workarounds.
With that picture, you can compare the options honestly: upgrade in place, pay for extended support while you plan, or modernise. The answer won't be the same for every application, and some are worth keeping on PHP with a proper upgrade. What matters is making the decision deliberately rather than having a breach or a forced upgrade make it for you.
Recommended next step
Before you budget for another year of "it still works", find out what your legacy PHP is really costing you. Take our free Legacy PHP assessment to identify which applications are on unsupported versions, where the security and maintenance risks sit, and which systems are worth upgrading, supporting or modernising.
Then talk to our team about the numbers. We'll tell you plainly when a migration doesn't pay for itself. When it does, a move to a modern stack such as Node.js may suit the application's requirements and your business goals, planned in stages so the business keeps running throughout. No platform removes the need for ongoing care, but on a current one, staying up to date can become routine maintenance rather than another emergency.
Free Legacy PHP Risk Assessment
Not sure what your legacy PHP is really costing you? We'll review your PHP versions, hosting, support arrangements and dependencies, and tell you plainly where you're exposed and what your options are, whether that's an upgrade, extended support or a migration.
