What is PHP and why it powers much of the web

I just want the website to work. But behind much of the World Wide Web is a programming language that's over three decades old. It's PHP.

We all recently learned what happens if they are in PHP vulnerabilities detected. The whole world is going crazy, and rightfully so. Two critical vulnerabilities in PHP could allow attackers to execute malicious code on remote servers without prior authorization. The developers took immediate action, but maybe now is the time to talk about what PHP is, why such an old technology is still dominant, and how a bug in one programming language can compromise the world wide web.

What is PHP and what does its name mean?

PHP is a programming language primarily intended for creating websites and web applications. The name is an abbreviation for PHP Hypertext Preprocessor, and originally meant Personal Home Page. From this alone, it is clear that the language grew out of a purely practical need to make websites more alive than just plain static text.

The language's origins date back to 1994, when Danish-Canadian programmer Rasmus Lerdorf developed simple tools to monitor visits to his personal website. These tools gradually evolved into a programming language that has become one of the key building blocks of the World Wide Web.

PHP is a scripting language. This means that the code is not compiled into a standalone program in advance, but is read and executed by a special service called an interpreter on each request. This saves the programmer a lot of the work that users of more rigorous languages have to do, making PHP very beginner-friendly. It is also open source, meaning that its source code is publicly available, and anyone can use and improve the language for free.

According to the research company W3Techs PHP was present on approximately 69.3 % websites where the server-side programming language used could be identified as of October 21, 2026. This does not represent 69.3 % of the entire Internet, but it is a clear indication of its prevalence.

How does PHP work?

The key word is server-side. When I open a web page in my browser, the browser sends a request to the server, i.e. the computer that stores the page and serves it to the visitor. If the page is written in PHP, the server first passes the code to the interpreter. The interpreter executes it, reads data from the database if necessary, compiles the final page in HTML, and sends it back to the browser. HTML is the language in which all web pages are written, and the browser can display it as text, images, and buttons. CSS determines its appearance, while JavaScript enables interactivity, such as responding to clicks, opening menus, and updating content.

The visitor therefore never sees the PHP code itself, only the result. This is also important from a security perspective, as the code often contains data for accessing the database. If an attacker gets hold of the code, they also get hold of this data.

We insert the PHP code into a regular web page between the tags . Everything inside them is executed by the interpreter, and everything else remains unchanged. It is this simplicity that was one of the main reasons for the rapid expansion of the language in the 1990s.

We often hear the acronym LAMP. It stands for the classic combination of the Linux operating system, the Apache web server, the MySQL database, and the PHP language. It is a set of free tools that has powered a huge part of the web for decades and still does so in many places today.

PHP is not just a language for simple websites

Although PHP originated in the era of a much simpler web, its capabilities today far exceed its original purpose. It can be used to develop online stores, business applications, user portals, reservation systems, and programming interfaces for exchanging data between different services.

Modern PHP supports object-oriented programming. The programmer can divide the programming logic into classes and objects that represent individual components of the application. It also supports data typing, exceptions for error handling, and many other mechanisms that allow for more organized and predictable programming code.

A programmer doesn't have to develop all the features from scratch. Frameworks like Laravel and Symfony are available that simplify the development of more complex applications. Composer, a dependency manager, also plays an important role. It allows developers to include ready-made libraries and control their versions.

Without databases, its usefulness would be much less.

One of PHP's key tasks is connecting web applications to databases. When I log in to an online store, the system needs to verify my user account. When I place an order, it needs to store the selected products, shipping address, and order information. PHP can work with systems like MySQL, MariaDB, PostgreSQL, and SQLite to do this.

For access to databases, PDO is available, among others. PHP Data ObjectsIt is a programming interface that allows working with different data systems. In doing so, the developer must pay special attention to security.

If an application inadvertently inserts user input into a database command, a vulnerability called SQL injection can occur. SQL is a standardized language for working with relational databases. An attacker can exploit such a flaw to read or modify data without authorization.

The recommended protection is to use prepared queries, where user data is treated separately from the command itself.

Why is PHP so closely associated with WordPress?

The best example of its prevalence is WordPress, one of the most widely used content management systems on the web. WordPress is based on PHP and a database. When an editor publishes an article, its content is stored in a database. PHP then takes care of retrieving the content, checking user permissions, and preparing the page that the visitor sees.

Similarly, Drupal and Joomla are also based on PHP, and the WooCommerce online store and the MediaWiki software that powers Wikipedia are also based on PHP. PHP also enables extensions, user accounts, forms, online stores, and many editorial functions. However, it is important to distinguish between vulnerabilities in PHP itself, bugs in WordPress, and problems with individual plugins.

For example, updating WordPress does not necessarily mean that PHP on the server is also updated. They are different software layers that require separate maintenance. This distinction is often overlooked, especially by less demanding users who leave server management to their hosting provider.

What did the latest critical vulnerabilities reveal?

The security alerts, labeled CVE-2026-109618 and CVE-2026-109619, are particularly serious because they concern the internal workings of PHP. CVE is a standardized international designation for publicly known security vulnerabilities. Both bugs received a CVSS score of 9.2, which rates the severity of security flaws on a scale of up to 10.

The first vulnerability is related to incorrect memory handling when the available memory runs out during the processing of a request. The second one is caused by the use of internal data associated with a previous request after its memory has already been freed. Under certain circumstances, an attacker could exploit such a flaw to execute remote code without logging into the application.

In the case of PHP, they specifically warn against the use of mod_php, where an attack has been demonstrated that can be triggered before the web application's code is executed. This means that even a properly written website is not necessarily protected if it uses a vulnerable version of PHP itself.

Will PHP lose its dominant position due to vulnerabilities?

PHP is neither a miracle tool nor a despicable relic. It is a mature, fast, and widely used language that, due to its simplicity, has opened the door to web programming for many. But this very widespreadness is its Achilles heel, as any serious mistake can compromise a large part of the web. For readers who manage their own website or store, the most important message is therefore simple. Update regularly and don't wait for the first attack.