PHP explained: what it is, how server-side scripting works, and why it matters

How PHP looks and behaves in practice

On a typical dynamic web page, you mix HTML with small blocks of PHP code. For example, the following minimal page demonstrates PHP running inside an HTML document. The PHP snippet prints a short message, and the surrounding HTML is what the browser downloads:

<!DOCTYPE html>
<html>
<head>
  <title>PHP Demo</title>
</head>
<body>
  <h1>Hello from a PHP page</h1>
  <?php echo 'Hi, I am a PHP script!'; ?>
</body>
</html>

Important takeaway: PHP code lives inside these delimiters, runs on the server, and only the generated HTML reaches the browser. A web server can be configured to process all HTML files with PHP, ensuring visitors never see the actual PHP code.

What is PHP used for?

PHP is not limited to producing static pages. It is a versatile language used for a wide range of server-side tasks, including handling form submissions, managing user sessions and cookies, accessing databases (via extensions like MySQL or PDO), generating JSON or XML for APIs, creating and delivering images or PDFs, sending email, performing encryption and security operations, and even running command-line scripts. In addition to web pages, PHP can be used for back-end APIs, data processing, and background tasks—often via cron jobs on Unix-like systems or Task Scheduler on Windows.

Common use cases include building dynamic websites, powering content management systems (CMSs) such as WordPress, and running custom web applications. PHP also supports command-line usage, making it suitable for small utilities and automation tasks beyond the web context.

A concise history and who maintains PHP

PHP originated in the early 1990s when Danish‑Canadian programmer Rasmus Lerdorf built a set of CGI programs to manage his personal homepage. In 1995 he released what was then called Personal Home Page Tools (PHP Tools), and the language gradually evolved from PHP/FI into the modern PHP we know today. Zeev Suraski and Andi Gutmans rewrote the parser in 1997, giving the project a solid foundation and the Zend Engine, which powered PHP 3 and beyond. The language was renamed to the recursive acronym PHP: Hypertext Preprocessor during the PHP 3 era.

Over the years, major milestones included the release of PHP 4 with the Zend Engine 1.0 in 2000, PHP 5 with a new object model in 2004, the long‑running but ultimately abandoned PHP 6 Unicode project, PHP 7 with the Zend Engine 3 in 2015, and PHP 8, which introduced a Just‑In‑Time (JIT) compiler and a richer type system starting in 2020. PHP is currently maintained by the PHP Group, with involvement from companies and the PHP Foundation to support core development and governance. The language is free software released under the PHP License, a BSD‑style license, and runs on a wide range of operating systems and servers.

Philologically, PHP began as a tool that grew organically rather than as a designed language. The story explains why some functions and naming conventions evolved in inconsistent ways early on, a situation later addressed by the more unified PHP 5 through PHP 8 design and tooling.

Adoption, licensing, and open‑source status

PHP is free and open source. It is released under the PHP License, which is BSD‑style and permissive for use and distribution. The language runs on major operating systems and is supported by a broad ecosystem of extensions and frameworks. The core development and governance involve entities such as the PHP Group and the PHP Foundation, which coordinate core development and support for the community.

As of late 2025, PHP remains widely deployed across the web. A widely cited source indicates that PHP powers a substantial portion of the web, with Figures from W3Techs showing PHP as the server-side language on a large share of sites where the language can be identified. These adoption figures reinforce why timely patching and clear guidance matter for site operators and developers alike.

The php2shell vulnerability and what it means for you

Two vulnerabilities discovered in PHP—tracked as CVE‑2026‑109618 and CVE‑2026‑109619—were disclosed this week and rated with high severity in the range of 9.2 out of 10. The vulnerabilities could allow remote code execution on vulnerable servers under certain conditions, potentially exposing data and enabling control of affected systems. In the public announcements, researchers from Wiz and Calif identified these flaws as intrinsic to the PHP language itself, affecting PHP versions released over the last decade. The disclosure timeline was accelerated by the public release of the technical details, prompting the PHP Foundation to issue fixes promptly.

In the hours and days after disclosure, security advisories from national and international authorities followed. Agencies including the US National Security Agency and counterparts in the EU, Singapore, and Australia issued alerts urging operators to patch quickly or consider temporary mitigations. Cloudflare reported a sharp spike in attempts to exploit the vulnerabilities across its network in the run‑up to and just after the public disclosure, with some estimates describing a rapid increase in attack attempts after the disclosure became public. The researchers noted that patch adoption would take time, even as organizations began applying fixes.

As of the initial reporting window, there were no publicly documented successful exploits reported, but experts warned that exploitation attempts were likely in the weeks that followed. In practice, this means site operators should apply the vendor‑provided PHP updates promptly, test changes in a staging environment if possible, and monitor advisories from vendors and hosting providers for any additional guidance.

A practical action plan for site owners

The core recommendation from the response community is to upgrade the PHP core to a currently supported release and to verify that the patch has been applied at the PHP layer itself, not just by updating WordPress or plugins. WordPress plugins and themes may be updated, but they do not substitute for patching PHP itself when vulnerabilities live in the language runtime. If you run a site on shared hosting, contact your hosting provider to confirm whether the latest PHP updates have been deployed and whether any server‑level mitigations are in place. If you manage your own server or run on a private environment, install the latest supported PHP version and restart services after testing, then monitor for any suspicious activity.

In addition to patching PHP itself, it is advisable to inventory non‑web surfaces where PHP runs. This includes the management interfaces of network appliances, load balancers, and embedded devices that may run PHP, since updating a web site alone is not sufficient to close the risk. Where possible, coordinate patching across these surfaces with vendors and internal teams. Finally, maintain vigilance for phishing or social engineering messages that reference the vulnerability or PHP in an attempt to lure users into clicking malicious links or disclosing credentials.

Trying PHP locally: a quick starter

For beginners who want to experiment with PHP outside of a web hosting environment, you can run PHP on your own machine. PHP runs on all major operating systems and can be paired with a local web server or with PHP’s built‑in development server to try PHP without configuring a full production stack. A simple test is to install PHP, run a local web server, and verify with a command like php -v to confirm the installation.

What everyday readers should know

Most users do not need to take immediate action unless they operate affected services or encounter specific guidance from a service they rely on. Stay alert for phishing or scam messages that reference the vulnerability, and follow instructions from services you use. If you manage a website, work with your hosting provider or developer to ensure that the PHP core is patched and that any web applications and plugins are up to date. The goal is to patch the underlying runtime rather than relying on partial updates, which do not close the security gaps.

Where PHP stands today: version support and usage

End‑of‑life dates for PHP versions provide critical guidance for decision‑making about upgrades. In brief, older PHP 7.x releases reached end‑of‑life in 2019–2022, while PHP 8.x releases remain the focus of ongoing development and security updates. Adoption data from web usage surveys shows a substantial share of sites still running older, unsupported versions, underscoring the urgency of upgrading where feasible. According to data from W3Techs (as of November 2025), approximately half or more of PHP sites still run on versions that are no longer supported, with PHP 7.x being the most common among those older branches and PHP 5.x representing a smaller but still present share.

Note: newer PHP 8.x releases continue to be the focus of security patches and feature improvements, while older 7.x releases are no longer maintained. For site operators, checking the end‑of‑life status of their current runtime helps determine urgency and timing for upgrades.

A quick note on learning PHP in context

Readers learning PHP should keep in mind that PHP is a server‑side language designed to deliver dynamic web content. It shares similarities with other server‑side languages such as Python, Java, and Node.js, but PHP’s ecosystem—especially its widespread hosting support and CMS integrations—makes it a practical choice for many web projects. If you are evaluating options, consider factors like hosting availability, CMS needs, ecosystem maturity, and the learning curve. PHP’s long history means a large amount of documentation, community support, and mature tooling are available, which can shorten the path from beginner to productive developer.

Frequently asked questions in plain language

What does PHP stand for? PHP originally stood for Personal Home Page Tools, then became the recursive acronym PHP: Hypertext Preprocessor. Is PHP free and open source? Yes. It is released under the PHP License and runs on major operating systems and servers. Do I need to learn PHP to build websites? Not necessarily, but PHP remains a common server‑side choice for many sites, especially those powered by WordPress and other CMS platforms. Do I need to patch my PHP installation if a vulnerability is disclosed? Yes. When vulnerabilities are disclosed, applying the latest supported PHP core updates is recommended, along with following any vendor guidance and ensuring that hosting environments are patched. Should I only patch WordPress or its plugins? Patching PHP itself is essential, because the vulnerability exists in the PHP runtime, not just in WordPress or plugins. Always apply server‑level updates in addition to any application updates.