A PHP upgrade compatibility scanner that tells you what will break
php2shell exists because a PHP upgrade usually fails in the same way: you change the runtime, deploy, and then spend the evening reading error messages that all point at code you have not touched in three years. The scan finds those places before you deploy.
What the tool does
You submit a PHP project. The engine reads the source files and applies a rule set that mirrors the Rector upgrade rule sets: removed functions, deprecated calls, dynamic properties, string interpolation changes, implicit nullable parameters and the removal of the automatic conversion of false to an empty string. Every match is reported with the file, the line, the PHP version it affects and the recommended change.
The automatic fixer then applies only the transformations that a program can apply safely, and it shows you the diff before it writes anything. What it cannot decide safely stays in the report as a manual task.
Who it is for
- Developers maintaining a legacy PHP application that has to move to a newer runtime.
- Agencies and hosting companies that upgrade many sites and need the same repeatable process every time.
- Technical leads planning a migration who need a written list of what will break before they commit a date.
It is a development tool. It is not a security scanner and it does not look for vulnerabilities in your application logic.
How a migration with php2shell runs
Scan
Submit the project and get the list of compatibility problems with the exact file and line.
Preview
Look at the dry-run diff. Nothing is written to your project until you confirm.
Fix
Apply the automatic fixes and read the change summary: what changed, what was fixed, what still needs a developer.
Verify
Paste the PHPUnit output and get the pass rate plus the list of failing test cases.
The AI model behind the assisted review
Some findings cannot be decided by a rule engine: whether a deprecated call can be replaced safely depends on the surrounding code. Those findings can be reviewed by an AI assistant, and you should know exactly which model answers them.
- Model: DeepSeek
deepseek-chat. - Access: through the DeepSeek API at
https://api.deepseek.com. - Who pays: php2shell. The AI review is included in the prepaid token quality pack. You do not bring an API key and php2shell does not resell API keys.
- What is sent: only the fragment you ask to review, and only after it has been de-identified. The de-identified fragment is used for the answer and then discarded.
How your code is handled
- The analysis runs on the server that hosts the tool. Your files are used to produce your result and are not shared with anyone else.
- For an AI assisted review, the code fragment is de-identified first: comments are stripped, string literals and variable names become placeholders, and credentials, e-mail addresses, URLs, IP addresses and file system paths are masked. The de-identified fragment is used for the answer and then discarded.
- You never bring your own AI API key and php2shell does not resell API keys.
- No tracking cookie, no third party advertising script. The browser local storage only keeps your session so you stay signed in.
The full text is on the privacy policy and the terms of service.
Try it on your own project
The first scan is free and needs no credit card.