TL;DR
- Pick the PHP migration company by migration type. A version upgrade, a framework migration and a move off PHP call for different partners, and few companies cover more than one.
- Plan around December 31, 2026. PHP 8.2 loses security support that day, and PHP 8.1 and older received no official release for the October 2026 PHP2Shell flaws.
- Confirm hands-on experience with your framework’s upgrade path. Laravel, Symfony and CodeIgniter upgrades each break different things, and vendors specialize accordingly.
- Ask every vendor how it proves the migrated application behaves like the original. Generated tests, recorded-input replays and a written rollback plan are the evidence to look for.
- Land every PHP 7 to 8 migration on PHP 8.4 or 8.5. PHP 8.1 is already unsupported, and PHP 8.3 security support ends December 31, 2027.
The Best PHP Migration Companies in the US for 2026
PHP migration companies move applications off unsupported PHP versions by upgrading the runtime and framework or by rebuilding the application on another platform. The leading PHP migration companies in the United States for 2026 are:
- Legacyleap
- Zend by Perforce
- Curotec
- Tighten
- Kirschbaum Development Group
- BairesDev
- Azumo
- Fingent.
All eight are US-headquartered and differ in migration type, framework focus and delivery model, which should drive the choice.
The deadline is fixed. PHP 8.1 reached end of life on December 31, 2025, and PHP 8.2 follows on December 31, 2026 [1][2]. In October 2026, the PHP project shipped fixes for PHP2Shell, two critical flaws in the PHP engine, in PHP 8.2 and newer only [3]. PHP 8.1 and older received no official release.
The installed base that has to move is large. PHP runs 69.2% of websites whose server-side language is known, and about a third of PHP sites still run PHP 7 or older [4].
The exposure itself and the first response steps are covered in PHP2Shell and PHP 8.1 end of life. This list is for the next decision, which is who does the migration.
PHP Migration Companies Compared: Headquarters, Migration Focus and Best Fit
The table below compares the eight PHP migration companies on the attributes that decide fit.
| Company | US headquarters | PHP migration focus | Delivery model | Best for |
| Legacyleap | Plano, TX | PHP version and framework upgrades (Laravel, CodeIgniter, Symfony) and rearchitecture to Java or .NET | Turnkey service or platform license, run inside the client’s environment | Enterprises with large or business-critical PHP estates |
| Zend by Perforce | Minneapolis, MN (Perforce) | PHP version upgrades, framework migrations, long-term support for end-of-life PHP | Professional services and LTS subscriptions | Enterprises that need a supported runtime during migration |
| Curotec | Philadelphia, PA | Legacy PHP to Laravel or Symfony, with Rector and PHPStan | US-led, with nearshore engineers | Mid-market and enterprise teams consolidating on Laravel or Symfony |
| Tighten | Chicago, IL | Laravel codebase upgrades and legacy PHP to Laravel | Small senior team | Laravel shops that want a hands-on upgrade partner |
| Kirschbaum Development Group | United States | Laravel rescue, upgrades and modernization | Senior remote team | Mid-market Laravel applications |
| BairesDev | San Francisco, CA | Legacy PHP refactoring, framework upgrades and infrastructure migration | Dedicated teams, delivered from Latin America | Teams that need engineering capacity at scale |
| Azumo | San Francisco, CA | Security patching followed by staged PHP version upgrades | Nearshore teams | Exposed applications that can’t move in one step |
| Fingent | New York | PHP application takeover and rescue, Magento 1 to 2 migrations | Global team, largely offshore | Mid-market ecommerce and CMS estates |
How These PHP Migration Companies Were Selected
A PHP migration partner has to move a live application safely onto a supported version, which takes more than PHP development skills. Every company on this list passed two tests.
- A public PHP migration offer. The company’s own site describes PHP version upgrades, framework migrations, or legacy PHP modernization, beyond general PHP development.
- A clear migration type. The offer is specific enough to match a buyer’s situation, such as a Laravel upgrade, an LTS bridge, or a move off PHP.
Top 8 PHP Migration Companies in the United States
1. Legacyleap
Headquarters: Plano, Texas
What they do in PHP migration: Legacyleap is a Gen AI modernization platform built on multi-agent orchestration, and its PHP migration services run on two paths.
- Upgrade within PHP. PHP 5.6, 7.x, 8.0, and 8.1 applications move to PHP 8.4 or 8.5, with the framework upgraded alongside the runtime. This covers Laravel version upgrades, CodeIgniter 3 to 4 migrations, and Symfony upgrades with deprecations resolved.
- Rearchitect off PHP. The backend moves to Java 25 or .NET 10 and the UI to React or Angular, for applications where the architecture itself has become the constraint.
How the work runs: Deterministic upgrade tooling handles the mechanical changes. Five agents (Assessment, Documentation, Recommendation, Modernization and QA) handle what rules can’t, and every change arrives as a diff-based pull request for human review. About 70% of the modernization is automated, modernization runs 70 to 80% faster, and code never leaves the client’s environment.
Best for: Enterprises with large, undocumented or business-critical PHP estates, and teams deciding application by application whether to upgrade or move off PHP.
Scope: The upgrade path covers Laravel, CodeIgniter and Symfony applications.
2. Zend by Perforce
Headquarters: Minneapolis, Minnesota (parent company Perforce)
Founded: 1999, by Andi Gutmans and Zeev Suraski, the creators of PHP 3 and the Zend Engine. Part of Perforce since 2019.
What they do in PHP migration: Professional services for PHP version upgrades and framework migrations across Laravel, Symfony, Laminas, CakePHP and CodeIgniter. Zend also sells PHP long-term support, with patched builds for end-of-life PHP 7.2, 7.3, 7.4 and 8.1, and offers a complimentary code assessment.
Best for: Enterprises that need their PHP runtime to stay patched during a migration.
Keep in mind: LTS buys time on an old version and leaves the migration still to do. Zend’s services center on upgrades within PHP.
3. Curotec
Headquarters: Philadelphia, Pennsylvania
Founded: Over 15 years in business
What they do in PHP migration: Curotec moves legacy PHP, CodeIgniter and Zend Framework applications onto Laravel or Symfony, and it names its tooling publicly. Rector automates syntax and framework upgrades, PHPStan enforces type safety at strict levels, and tests are added at each step as the application stays live. Curotec is a Laravel Premier Partner.
Best for: Mid-market and enterprise teams consolidating legacy PHP onto Laravel or Symfony.
Keep in mind: Delivery draws on nearshore engineers in Latin America, and its published work leans toward Laravel overhauls more than pure version upgrades.
4. Tighten
Headquarters: Chicago, Illinois
Founded: 2012
What they do in PHP migration: Tighten is a Laravel Premier Partner with a dedicated codebase upgrades service. It audits, upgrades, stabilizes and rescues Laravel applications, and converts legacy PHP applications to Laravel with a Vue front end.
Best for: Laravel shops and teams moving a legacy PHP application onto Laravel that want a senior, hands-on partner.
Keep in mind: Tighten is a small team focused on Laravel, so Symfony, Drupal or WordPress estates and large multi-application portfolios may fall outside its focus.
5. Kirschbaum Development Group
Headquarters: United States
Founded: 2011
What they do in PHP migration: Kirschbaum is a Laravel Premier Partner for North America whose listed specialties are rescue, review and modernization, with migrations and upgrades offered inside its Laravel practice. It is also the official development agency of Filament, the admin panel framework for Laravel.
Best for: Mid-market companies with Laravel applications that need rescuing or bringing up to current versions.
Keep in mind: Public detail on PHP version upgrades is thin, and its published case studies don’t name clients or versions, so ask for version-specific references.
6. BairesDev
Headquarters: San Francisco, California
Founded: 2009, in Buenos Aires
What they do in PHP migration: BairesDev offers legacy PHP modernization and migration through codebase refactoring, framework upgrades across Laravel, Symfony and Laminas, and infrastructure migration. Static analysis with PHPStan and Psalm is part of its quality process, and it has more than 4,000 people.
Best for: Companies that need to staff a large PHP migration quickly with dedicated engineering teams.
Keep in mind: BairesDev works as an engineering-capacity partner with delivery from Latin America, so the migration method and the proof of equivalence depend on how the engagement is scoped.
7. Azumo
Headquarters: San Francisco, California
Founded: 2016
What they do in PHP migration: Azumo runs a legacy PHP security patching and upgrade service built around the PHP2Shell window. It audits the codebase and closes known vulnerabilities first, then upgrades in controlled increments through staging, regression tests and staged deployment, with a documented rollback plan.
Best for: Applications that are exposed today and can’t move to a supported PHP version in one step.
Keep in mind: Delivery is nearshore, and public case evidence for PHP version upgrades is limited.
8. Fingent
Headquarters: New York
Founded: 2003
What they do in PHP migration: Fingent takes over in-progress or stalled PHP applications, audits the codebase and works across PHP 7.4 to 8.3, with Laravel, Symfony, CodeIgniter, Drupal, WordPress and Magento in scope. Its ecommerce practice handles Magento 1 to Magento 2 migrations on live stores.
Best for: Mid-market companies with PHP-based ecommerce or CMS platforms that want a broad custom software partner.
Keep in mind: Fingent is a generalist with 450+ professionals and its main delivery centers in India, and PHP is one practice among many.
How to Choose a PHP Migration Company: Seven Criteria and the Questions to Ask
A shortlist narrows to one vendor on seven criteria. Each row pairs what good looks like with the question that tests it.
| Criterion | What good looks like | Question to ask |
| Your version jump | Completed projects from your starting version (5.6, 7.x or 8.1) to your target | Which PHP and framework versions have you migrated in the last two years? |
| Framework depth | Experience with your framework’s upgrade path, such as CodeIgniter 3 to 4 | How do you handle our framework’s breaking changes? |
| Upgrade tooling | Rector, PHPStan and PHPUnit or Pest, plus a review plan for automated changes | How do you review changes across hundreds of files? |
| Test strategy | Characterization tests or recorded-input replays when no test suite exists | Will you deliver a test suite with the migration? |
| Cutover method | Incremental releases, the strangler fig approach where it fits, and a rollback plan | What happens if production breaks after cutover? |
| Team and delivery model | Named senior engineers, a clear onshore or offshore split, one accountable owner | Who works on our code, and where are they based? |
| Support after go-live | Post-migration support, a documented handover, or an LTS bridge | Do you support the application after go-live? |
The tooling and test rows carry the heaviest weight. Automated upgrade tools handle the bulk of a PHP 7 to 8 migration, and a single Rector run on a legacy codebase can touch hundreds of files. Confirming that each of those changes preserves behavior is where the effort and the risk sit.
When an Automated PHP Upgrade Tool Is Enough
Teams that migrate PHP 7 to 8 with spare capacity, a solid test suite and a Laravel application can run the upgrade themselves with Laravel Shift or Rector. A PHP migration company earns its fee when the application has no tests, the version jump is large, or the team can’t pause feature work.
The broader trade-offs of running modernization in-house or outsourced apply here too.
Find Out Which PHP Applications Are Exposed
The $0 PHP Assessment maps every legacy PHP application, flags the CVEs that can’t be patched and recommends a path for each, in 3 to 5 days inside your infrastructure.
Claim your $0 PHP Assessment →PHP 7 to 8 Migration and PHP 8.x Upgrade Targets by Version
| Current version | Support status | Recommended target | Target supported until |
| PHP 5.x | Ended (5.6 ended December 31, 2018) | PHP 8.4 or 8.5 | December 31, 2028 / December 31, 2029 |
| PHP 7.x | Ended (7.4 ended November 28, 2022) | PHP 8.4 or 8.5 | December 31, 2028 / December 31, 2029 |
| PHP 8.0 | Ended November 26, 2023 | PHP 8.4 or 8.5 | December 31, 2028 / December 31, 2029 |
| PHP 8.1 | Ended December 31, 2025 | PHP 8.4 or 8.5 | December 31, 2028 / December 31, 2029 |
| PHP 8.2 | Ends December 31, 2026 | PHP 8.4 or 8.5 | December 31, 2028 / December 31, 2029 |
| PHP 8.3 | Ends December 31, 2027 | PHP 8.4 or 8.5 | December 31, 2028 / December 31, 2029 |
Teams that upgrade PHP 7.4 to 8 should skip intermediate releases as targets, since an upgrade from PHP 7.4 to 8.1 lands on a version unsupported since December 31, 2025. A PHP 7.4 upgrade to 8.4 or 8.5 can target the newer runtime directly, with the code and framework stepped through intermediate versions along the way.
A PHP 8.1 migration is already overdue, and a PHP 8.2 migration has until December 31, 2026, when that branch stops getting official security fixes. A PHP 8.3 migration has until the end of 2027, and planning it now avoids a second project. A PHP 8.4 upgrade buys support to December 31, 2028, and PHP 8.5 adds one more year.
The choice between PHP 8.4 and 8.5, and when to rearchitect instead, is covered in the PHP migration guide.
How Legacyleap Runs PHP Migration With Gen AI Agents and an Evidence Pack
The criteria above ask three things of a vendor. It has to handle your version jump and framework, change the code without losing control, and prove the result behaves like the original. Legacyleap, a Gen AI modernization platform built on multi-agent orchestration, carries each PHP application through the full lifecycle to meet all three.
- Assess. The Assessment Agent maps technical debt, dependencies, risk and effort, and the Recommendation Agent sorts each application into an upgrade or a rearchitect with ordered migration phases.
- Comprehend. The Documentation Agent reconstructs architecture, data flows and business logic, including in applications with no documentation.
- Modernize. Deterministic upgrade tooling handles the predictable changes, and the Modernization Agent handles what rules can’t. Every change is a diff-based pull request, and AI cannot merge or deploy code.
- Validate. The QA Agent generates unit, integration and regression tests and produces the evidence pack.
- Deploy. CI/CD-ready artifacts support phased cutover, the approach behind zero-downtime migration, with no big-bang release.
The evidence pack is how equivalence gets proven. Real inputs are recorded, replayed against the old and new application, and the outputs are compared with checksums. Anyone can rerun the tests, so the team can check equivalence for itself.
Two delivery models fit different teams. With Turnkey Modernization Services, Legacyleap’s team owns the PHP migration end to end. With Platform Licensing, internal or SI teams run the platform in their own environment and keep their existing workflow.
The entry point is the $0 PHP Assessment, which maps each legacy PHP application, flags unpatchable CVEs and recommends a migration path for each in 3 to 5 days.
Choosing a PHP Migration Company Before PHP 8.2 Reaches End of Life
PHP 8.1 is already unsupported, and PHP 8.2 joins it on December 31, 2026. The PHP migration companies on this list cover different parts of that problem.
- Zend bridges the gap with long-term support during upgrades.
- Curotec, Tighten and Kirschbaum consolidate applications onto Laravel or Symfony.
- BairesDev and Fingent add engineering capacity, and Azumo starts from security remediation.
- Legacyleap covers both paths, upgrading within PHP or moving to Java or .NET, with proof of equivalence before cutover.
The right partner also depends on whether platform-led or services-led modernization suits how your team works.
Start With a $0 PHP Assessment
Legacyleap maps every legacy PHP application, flags the CVEs that can’t be patched and recommends a path for each one, whether an upgrade to PHP 8.4 or 8.5 or a rebuild on Java 25 or .NET 10. Findings arrive in 3 to 5 days, the work runs inside your infrastructure, and no source code leaves it.
Claim your $0 PHP Assessment →To walk through how Legacyleap would handle your PHP applications, book a demo.
FAQs
A PHP upgrade moves an application to a newer PHP version on the same codebase. A PHP migration can also cover a framework change or a move to another language, so confirm which one a vendor’s quote covers.
An upgrade fits when the framework still has a supported release and the architecture serves the business. A full migration fits when the framework is abandoned or the architecture itself blocks the changes the business needs.
Support is usually scoped separately, so write the warranty period, defect response times and ownership of the test suite into the contract before work starts.
Watch for missing references for your version jump, no plan for testing an application without tests, and a fixed timeline quoted before anyone has read the code. No named engineers or single accountable owner for your account is another.
Yes. Upgrade work delivered as reviewable pull requests lets your team keep shipping features, and platform-licensing models let your own engineers run the migration with vendor tooling.
No official PHP release fixes PHP2Shell on 8.1 or older. Only source-level backports and some commercial LTS builds exist, which makes a PHP 8.1 migration to a supported branch the durable fix.
References
[2] PHP, Unsupported Branches.
[3] PHP security advisory, October 21, 2026.
[4] W3Techs, Usage statistics of PHP (data as of October 27, 2026).
