A nightly cron failed silently for two days. That was our PHP 5.6 upgrade.
5.6 is out since the end of August, and we moved one production project this month. The syntax part is pleasant and minor. Variadics:
function log_all($level, ...$messages) { }
Argument unpacking with ...$args on the call side. Constant expressions in defaults. use function for importing functions. All nice. None of it changes your architecture. You will use variadics maybe twice a year and be happy both times.
The part that breaks production is TLS. Since 5.6 PHP verifies peer certificates by default on every encrypted stream. Before, file_get_contents('https://...') and friends accepted any certificate unless you configured verification yourself. Almost nobody did. I did not.
So after the upgrade every outgoing https call in your code becomes strict. The old script that talks to some partner API through a self-signed certificate, or through a host with an incomplete chain, starts throwing. Ours was in the nightly cron. No monitoring on the cron, no email on failure, two days of missing data.
My checklist for this upgrade, in order of importance. Grep the code for outgoing http calls and test each one against the real endpoint, not a mock. Run the test suite on 5.6 and watch the deprecation warnings. Check json_decode edge cases if you parse third-party JSON. Only then look at the new syntax.
Certificate verification by default is the right decision, years late. Right decisions also break things.
I read the migration guide before the upgrade. The TLS section was there. I skipped it because it looked like a security paragraph.