cyberpolycrisis.com

legacy PHP: Business owner report

Expanded web report · Related PDF snapshot: 22 October 2026 · PDF page 10

Research reviewed 22 October 2026 · Evidence and editorial planning guidance are distinguished below.

Download PDF

Choose the investment and accept the residual risk

Compare lifecycle costs and continuity rather than only the next hosting invoice. A temporary security backport may buy time, but it does not establish long-term maintainability. Managed commerce can transfer some runtime responsibilities while leaving data, staff access and integrations with the business.

Your immediate priorities

  • Approve a time-bounded legacy exception and a replacement assessment.
  • Compare upgrade and Shopify migration options using actual workflows, delivery cost and exit requirements.

How to work through the decision

Compare the cost of interruption, response and sustained improvement separately. Use your actual trading volumes, staff costs and contractual commitments; this report supplies no universal loss estimate. Identify who can approve emergency spending and who can accept a temporary exception. A supplier change should have measurable acceptance criteria, retained responsibilities and an exit route, rather than an assumption that a brand eliminates risk.

Evidence to ask for

A funded lifecycle decision with an owner and a deadline for revisiting temporary support.

What is the credible cost and operating consequence of remaining on this system for another year?

Work with the next person

Give the business manager a clear continuity priority, spending authority and escalation threshold. Ask for unresolved decisions and evidence gaps, not only a red, amber or green status.

Continue with the business manager report for this topic.

A scenario to rehearse

Illustrative exercise, not an observed customer incident: A custom discount extension prevents a runtime upgrade. The exercise compares changing that behavior with continuing emergency maintenance, while preserving order history and a reversible cutover plan.

What a useful outcome looks like

A funded lifecycle decision with an owner and a deadline for revisiting temporary support. Keep the decision dated and return to it if new evidence changes the scope.

Sources and further reading

What does this mean for your business?

Use the Cyber Health Review to turn the research into priorities for your own operating model.

Contact help@cyberpolycrisis.com