PHP is one of the most widely used programming languages on the internet, quietly running behind nearly 70% of all websites whose server-side technology can be identified. In October 2026, however, this three-decade-old workhorse made global headlines for a very different reason: a pair of critical security flaws, collectively named PHP2Shell, left millions of web servers vulnerable to takeover by attackers who did not even need to log in. Understanding what PHP is, how it works, and how these vulnerabilities operate offers a clear view into the technology that powers much of the modern web.

What Is PHP, Exactly?

PHP stands for "PHP: Hypertext Preprocessor," a recursive acronym typical of the open-source world. It is a general-purpose, server-side scripting language created specifically for web development. Unlike HTML, CSS, or JavaScript, which run inside a visitor's web browser, PHP code executes on the web server itself. When someone requests a page, the server runs the PHP script, generates plain HTML, and sends only that HTML back to the browser. The visitor never sees the underlying PHP code, which is why the language is well suited to handling sensitive tasks such as database queries, user logins, and form processing.

How PHP Works Behind the Scenes

The core idea behind PHP is simple: the work happens on the server, not in the browser. When a user types a URL or submits a form, the request travels to the web server, where the PHP engine processes the script. That script can pull data from a database, check a user's credentials, or build a page on the fly. The server then returns the finished result to the browser as ordinary HTML, so the user receives a complete page without ever seeing a line of code.

This server-side model makes PHP ideal for dynamic, interactive websites. A single PHP file can collect form data, generate customized content, manage sessions and cookies, and read or write to databases such as MySQL. PHP can run as an Apache module, known as mod_php, or as a standalone process using FastCGI or PHP-FPM, which gives developers flexibility in how they deploy it across different operating systems and web servers. Because it is open source and free to use, it has become one of the most accessible entry points into backend web development.

A 30-Year Journey From Personal Home Page to the Modern Web

PHP was created in 1993 and 1994 by the Danish-Canadian programmer Rasmus Lerdorf, who originally built it as a set of tools for tracking visits to his online resume. He called it "Personal Home Page," a name that later evolved into the recursive acronym used today. PHP 1.0 was released in June 1995, and the language grew quickly from there. In 1998, Andi Gutmans and Zeev Suraski rewrote the core parser and released PHP 3, which marked its transformation into a full-fledged programming language.

The release of PHP 4 in 2000 introduced the Zend Engine, the execution engine that still powers PHP today, while PHP 5 in 2004 brought a much-improved object-oriented programming model. PHP 7, released in 2015, delivered dramatic performance gains, and PHP 8, launched in 2020, added a just-in-time (JIT) compiler. Those steady improvements help explain why, more than 30 years after it began, PHP remains a foundation of the web.

Why PHP Is Everywhere: WordPress, Laravel, and 70% of the Web

PHP's biggest strength is its enormous installed base. According to W3Techs, PHP is used by roughly 69% of all websites whose server-side programming language can be identified, and other estimates place the figure even higher. Much of that reach comes from WordPress, the content management system built entirely in PHP that now powers more than 40% of all websites. Other widely used platforms and frameworks, including Drupal, Joomla, Laravel, and Magento, are also built on PHP.

Within the PHP ecosystem, version 8 is now dominant, running on about 65% of PHP-powered sites. Because PHP is free, open source, and relatively easy to learn, it remains a popular choice for everything from small personal blogs to large enterprise applications, which is precisely why a flaw in the language itself can have such far-reaching consequences.

PHP2Shell: The Critical Flaw That Shook the Web in 2026

In late October 2026, the security world was gripped by the disclosure of two critical vulnerabilities in PHP itself, collectively dubbed PHP2Shell. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, affect PHP versions 5.4 through 8.5 and carry a Common Vulnerability Scoring System (CVSS) rating of 9.2 out of 10, placing them firmly in the critical range. Most alarmingly, they allow remote code execution, meaning an attacker can run arbitrary code on a vulnerable server without needing to authenticate or log in.

The first flaw, CVE-2026-109618, is a memory corruption bug triggered by an out-of-memory condition. When PHP runs out of memory during request processing, it uses a mechanism called longjmp() to abort the operation. Under certain conditions, internal state is not properly cleaned up, which can corrupt memory in a way that lets an attacker read sensitive process data or execute code. The second flaw compounds the risk. Because the vulnerability sits inside the PHP runtime rather than in any particular application, it affects a vast range of software, including sites running WordPress and Laravel alike.

A notable detail is how these flaws were uncovered. Security researchers, including teams using AI-assisted analysis, helped surface the vulnerabilities, a sign of how automated tooling is increasingly finding bugs in widely used software.

Timeline: From Discovery to Emergency Patch

The events around PHP2Shell unfolded rapidly over just a few days. Exploitation of the vulnerabilities is believed to have begun around October 17, 2026, before a public fix was available. On October 20, the PHP project announced an upcoming security release, and government security bodies such as the UK's National Cyber Security Centre (NCSC) and the EU's CERT issued urgent advisories. On October 21, 2026, PHP released emergency patches, fixing the flaws in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

There is an important caveat: PHP 8.1 and all older branches receive no upstream patch, leaving those installations dependent on distribution-specific fixes or a full upgrade. Security firms soon reported that the vulnerabilities were being actively exploited at scale, and researchers demonstrated that some exploit techniques could even bypass protections designed to stop remote code execution.

How to Protect Your Server From PHP2Shell

For anyone running a web server, the guidance is straightforward. The only complete fix is to update PHP to a patched version, 8.5.12, 8.4.27, 8.3.36, or 8.2.35, and then restart every service that uses PHP. Because PHP often runs in long-lived processes, simply installing the update is not enough; the running PHP workers must be restarted for the patch to take effect.

Administrators should also inventory every PHP installation, since a single server can host multiple PHP versions. Environments that run PHP as an Apache module, mod_php, are considered among the highest risk. If immediate patching is not possible, security teams recommend reducing exposure by limiting which services are reachable and applying temporary mitigations, though upgrading remains the only true fix.

Key Takeaways

  • PHP is an open-source, server-side scripting language created by Rasmus Lerdorf in 1993 and first released in 1995.
  • PHP code runs on the server and returns plain HTML to the browser, making it ideal for dynamic websites and database-driven applications.
  • PHP powers roughly 69% of websites with a known server-side language, largely through WordPress, Laravel, and other platforms.
  • PHP2Shell refers to two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting PHP 5.4 through 8.5.
  • The flaws allow unauthenticated remote code execution and were patched on October 21, 2026 in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
  • PHP 8.1 and older receive no upstream fix, and administrators must restart PHP services after upgrading.