So what is PHP? And does it affect you? Here’s what you need to know.
What is PHP?
PHP is known as a general-purpose programming language that is often used in web development. Running on a server, it allows websites to handle complex actions without having to insert instructions or content within the pages. Examples of dynamically generated results include displaying the current calendar date, HTML and PDF, and even JSON and XML files for caching purposes.
Many websites use server-side languages to serve content, and of those that do, some sources (such as W3Techs) estimate that almost 70 percent rely on PHP. On the Internet as a whole, W3Techs believes that around 40 percent of all websites (yes, all of them!) run on WordPress, a major adopter of PHP.
Why PHP was in the news?
On October 20, 2026, PHP Group (which maintains PHP) published an alert for upcoming security updates, designed to patch two very high-risk vulnerabilities later named CVE-2026-109618 and CVE-2026-109619. Both allow an attacker to execute remote code, have a severity rating of 9.2 out of 10, and affect “all PHP installations that serve web requests,” according to the PHP Group.
The notice sparked an uproar on the web, with server administrators hastily preparing for patched versions of PHP. When details of the two vulnerabilities were published the next day, on October 21, websites began to temporarily go offline as PHP updates were completed, including government websites in the Netherlands, France, and Germany.
Why is this so important?
Two main reasons: the number of sites affected and the speed with which vulnerabilities can now be exploited.
