So what is PHP? And does it affect you? Here’s what you need to know.
What is PHP?
PHP is known as a general-purpose scripting language often used in web development. Run on a server, it allows websites to handle complex actions without having to embed instructions or content within pages. Examples of dynamically generated output include showing the current calendar date, HTML and PDFs, and even JSON and XML files for caching purposes.
Many websites use server-side languages to serve content, and of those that do, some sources (like W3Techs) estimate that almost 70 percent rely on PHP. Across the broader internet, W3Techs believes around 40 percent of all websites (yep, all!) run on WordPress—a major adopter of PHP.
Why did PHP blow up in the news?
On October 20, 2026, the PHP Group (which maintains PHP) released an alert for coming security updates, designed to patch two very high-risk vulnerabilities later named as CVE-2026-109618 and CVE-2026-109619. Both enable an attacker to run remote code, carry a severity rating of 9.2 of 10, and affect “all PHP installations serving web requests,” according to the PHP Group.
The advisory set off a flurry across the web, with server administrators hurriedly preparing for the patched versions of PHP. When details of the two vulnerabilities released the next day on October 21, sites across the web began going offline temporarily as PHP upgrades were completed—including government websites in the Netherlands, France, and Germany.
Why is this a big deal?
Two main reasons: The number of affected sites, and how fast vulnerabilities can now be exploited.