What Is PHP? Understanding the Language Powering the Web

PHP is the open-source, server-side scripting language that quietly runs behind a huge share of the websites you visit every day — by some estimates, nearly 70 percent of the web. Its name is a recursive acronym for "PHP: Hypertext Preprocessor," and it turns otherwise static pages into dynamic, data-driven experiences. PHP has surged back into the headlines in late October 2026 after researchers disclosed two critical security flaws, nicknamed "PHP2Shell," that could allow attackers to remotely execute code on vulnerable servers. Before the news cycle moves on, it is worth stepping back to answer a simpler question: what is PHP, how does it actually work, and why does so much of the internet depend on it?

What Exactly Is PHP?

PHP is a general-purpose scripting language built for web development. Unlike a plain HTML page, which shows the same content to every visitor, PHP lets a website generate content on the fly — reading from a database, processing a submitted form, or tailoring a page to an individual user. PHP code is stored in ordinary text files that usually end in the .php extension, and it is executed on the web server rather than in the visitor's browser.

Because it is open source, PHP is free to download, use, and modify. It runs on Windows, Linux, and macOS, and it works with most major web servers, including Apache and Nginx. The language is loosely typed and forgiving for beginners, which is part of why it became the default entry point for a generation of web developers. It can be embedded directly inside HTML, so a single file can mix static markup with dynamic logic, making it easy to get a small site running quickly.

How PHP Works on a Server

To understand PHP, it helps to understand the difference between server-side and client-side code. Client-side languages such as JavaScript run in the visitor's web browser after a page has been delivered. PHP, by contrast, runs on the server before anything is sent to the browser. The typical flow looks like this:

• The visitor's browser sends an HTTP request for a page, such as index.php.
• The web server recognizes the .php extension and hands the file to the PHP interpreter.
• The interpreter executes the PHP code, which might query a database or process form input.
• The interpreter outputs plain HTML, which the server sends back to the browser as the response.

The visitor never sees the PHP code itself — only the HTML it produces. A minimal example looks like this:

<?php
$name = "visitor";
echo "Hello, " . $name . "!";
?>

When that snippet runs, the server sends back the text "Hello, visitor!" as HTML. The same file could instead read the visitor's name from a database, pull today's headlines, or check a login session. This is what makes PHP so useful: it can create, open, read, write, and delete files on the server; collect form data; send and receive cookies; add, modify, and delete records in a database; control user access; and encrypt data.

From "Personal Home Page" to the Modern Web

PHP began in 1994, when Danish-Canadian programmer Rasmus Lerdorf wrote a small set of scripts to track visits to his online résumé. He called them "Personal Home Page Tools." In 1995, he released an expanded version called PHP/FI — short for Personal Home Page/Form Interpreter — which added the ability to process web forms and interact with databases. Over the following years the project was rewritten and formalized, and the name evolved into the recursive "PHP: Hypertext Preprocessor."

That modest origin helps explain the language's approachable, practical design. PHP was never meant to be a purely academic language; it was built to get real websites working quickly. Today the PHP Group maintains the language, releasing regular versions — the current supported releases include PHP 8.2, 8.3, 8.4, and 8.5 — with new features, performance improvements, and security fixes.

Where PHP Powers the Web Today

PHP's reach is enormous. According to W3Techs, PHP is used by roughly 69.3 percent of all websites whose server-side programming language is known, and about 65 percent of PHP sites run some version of PHP 8. The single biggest driver of that footprint is WordPress, the content management system built on PHP that powers roughly 41 percent of all websites — more than four in ten sites on the internet. Other widely used PHP projects include Drupal and Joomla (both content management systems), Laravel and Symfony (web application frameworks), and Magento (an e-commerce platform). Historically, PHP also powered early versions of major platforms such as Facebook and Wikipedia.

PHP is especially popular with databases. It has built-in support for MySQL — the database behind WordPress and countless other applications — as well as PostgreSQL, Oracle, and others. That tight integration between a scripting language and a database is a core reason PHP remains the backbone of so many blogs, online stores, forums, and business applications.

Understanding the PHP2Shell Vulnerability

On October 20, 2026, details of two critical vulnerabilities in PHP's core engine leaked online before an official announcement, triggering a rush among governments, cloud providers, and hosting companies to patch. Security researchers dubbed the pair "PHP2Shell" because exploiting them can hand an attacker a command-line shell — full remote control of a server — without needing to log in.

The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619, each rated 9.2 on the CVSS severity scale. Both are memory-safety bugs in the PHP runtime itself, rather than mistakes in any particular website or application. One, CVE-2026-109618, involves how PHP uses a function called longjmp() to recover from out-of-memory errors; mishandling that recovery can corrupt memory and, in the right conditions, allow remote code execution. The second, CVE-2026-109619, stems from a use-after-free in fatal-error handling and a type-confusion issue related to PHP's OPcache. The bugs affect nearly every PHP version going back to PHP 5.4, which means the exposure is unusually broad.

The discovery itself made headlines for another reason: the flaws were found with significant help from artificial intelligence. OpenAI said its GPT-5.6 Sol model assisted security researchers working under a "Patch the Planet" initiative, and the company coordinated the disclosure with the PHP team. The FBI's cyber division warned that the vulnerabilities could let malicious actors remotely execute code, the NSA advised organizations to take systems offline if they could not patch immediately, and Cloudflare rolled out default web application firewall protections — reporting tens of thousands of exploit attempts within 45 minutes of disclosure.

On October 21, 2026, the PHP project released emergency security updates. The fixes landed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and the team also provided source backports for older, end-of-life branches such as PHP 7.4, 8.0, and 8.1 — important because roughly a third of WordPress sites still run PHP 8.1 or earlier.

What to Do Next: Patching and Staying Safe

For anyone running a PHP-based site, the advice from security teams is consistent: update immediately. Updating to a patched PHP release is the only complete fix, and the PHP Group, CERT-EU, and cloud providers have all published guidance. If a website cannot be updated right away, administrators can reduce risk by ensuring the server runs a web application firewall with the latest PHP2Shell rules, restricting network exposure, and monitoring logs for unusual activity.

The episode is also a reminder of a broader lesson about the web's foundations. A language that quietly powers the majority of websites is, by definition, a high-value target. Keeping it updated matters far more than most site owners realize — one critical patch can protect millions of sites at once.

The Bottom Line: Key PHP Takeaways

• PHP is a free, open-source, server-side scripting language built for web development.
• It runs on the server and outputs HTML, which is why users never see the underlying code.
• Created by Rasmus Lerdorf in 1994, PHP evolved from simple "Personal Home Page" tools into the engine behind WordPress, Drupal, Laravel, and more.
• Roughly 69 percent of websites with a known server-side language use PHP, and WordPress alone powers about 41 percent of all sites.
• In October 2026, two critical flaws — "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619) — were patched in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
• Keeping PHP updated is the single most effective way to protect the sites that depend on it.