PHP Patch Drill – Pre-patch readiness for legacy PHP

A pre-flight check and drill workflow for solo devs maintaining piles of old PHP projects

Problem

A company's only technical person has every project running on PHP 7, and the PHP team has pre-announced an emergency security release with CVSS 9.2 vulnerabilities. The community panic is real: legacy projects have tangled dependencies and unclear upgrade paths, so patching risks breaking production while not patching risks becoming a botnet node. Once the patch ships, attackers can read the diff for a PoC, leaving a very short window.

Solution

A local or self-hosted checker that scans dependencies and framework versions, flags extensions and deprecated APIs that conflict with the PHP upgrade, and generates a phased upgrade plan (container dry run first, then canary). It ships with a pre-upgrade checklist and rollback script templates, and on patch day you tick items off as you go.

Users

Developers single-handedly maintaining legacy PHP projects at small companies, plus indie devs doing maintenance contracts

MVP

Parse composer.json/composer.lock and php -v output to flag compatibility risks; generate a risk-ranked upgrade checklist; provide Docker dry-run script templates; one-click rollback and backup checklist; keep a history of past runs

Revenue

Free CLI with a paid web report and team template pack; or per-project subscription, selling team seats to maintenance agencies

Why now

PHP's rare advance notice of a critical security release highlights a long-ignored group of legacy maintainers. Compatibility rules and checklists can be accumulated over time with no LLM or heavy infra needed