What is PHP, and why does a PHP bug matter if you've never written code?
PHP is a programming language for building websites. The PHP project describes it as "a widely-used open source general-purpose scripting language that is especially suited for web development". It runs on the computer that sends out a web page, called the server, and not on the phone or laptop you read the page on. This guide is accurate as of 23 October 2026.
Quick answer
PHP is an open source language that many websites are written in. Its code runs on the website's server, which builds each page and sends the finished result to your browser. That's why a flaw in PHP is a problem for the people who run websites, and why the fix is an update on the server, not on your device.
What is PHP used for?
Mostly for making web pages that change. A plain web page is a fixed file. A PHP page is a small program that writes the page at the moment you ask for it, so it can show your basket, your account or the latest posts.
The PHP manual says the language is "mainly focused on server-side scripting", and gives examples of what that covers: collecting form data, generating page content as it's requested, and sending and receiving cookies. Its front page puts it more broadly, saying PHP "powers everything from your blog to the most popular websites in the world".
You may also meet PHP without seeing its name. WordPress says PHP "is one of the programming languages that WordPress is built on". The PHP manual adds that PHP can also run on its own as a command line tool, for scheduled scripts and simple text processing.
What does "server-side" mean for a website and its visitors?
It means the work happens on the website's computer before anything reaches you. The PHP manual explains the difference from JavaScript, which runs in your browser: with PHP, "the code is executed on the server, generating HTML which is then sent to the client". The client is your browser.
So when you open a page on a PHP site, the server runs the PHP, produces an ordinary web page, and sends you that page. The manual says the client receives the results of running the script "but would not know what the underlying code was". It also says a server can be set up so that "there's no way that users can tell that PHP is being used".
For a visitor, that has two plain consequences. You don't need PHP installed to use a PHP website, and you usually can't tell whether a site uses it.
Why does one flaw in PHP affect so many sites?
Because every site that uses PHP runs the same core software, a flaw in that core is shared by all of them until each one is updated. On 21 October 2026 the PHP project announced two critical flaws, CVE-2026-109618 and CVE-2026-109619, and said the people at risk were "all PHP installations serving web requests". The UK's National Cyber Security Centre (NCSC) wrote that "Organisations using any version of PHP are affected".
None of the official sources for this guide give a count or a percentage of websites that use PHP, so we don't give one here. What they do say is that PHP is widespread and sometimes hard to spot. The US Cybersecurity and Infrastructure Security Agency (CISA) says "PHP is often a component of other software and prevalence may not be directly observable", and the NCSC tells organisations to watch for updates from vendors of "appliances and services that may bundle PHP". WordPress's own page on updating PHP says that "Because PHP is so popular, it is a target for hackers".
The flaws themselves, how serious they are and which versions fix them are covered in our hub guide, PHP2Shell explained.
Why doesn't my own device run the site's PHP?
Because PHP runs where the website lives. Your browser asks the server for a page, the server runs its PHP, and what comes back to you is the finished page, written in HTML. The PHP advisory of 21 October names server setups as the places at risk, listing setups such as PHP-FPM, Apache with mod_php and LiteSpeed, all of which run on web servers.
Visiting a site that runs an old or unpatched PHP version doesn't put that PHP onto your phone or laptop. The risk for visitors is different: if attackers take over a site, they can change what it shows you. Our guide can visiting a hacked website hack you? goes through what that looks like and what to watch for.
The one exception is if you've installed PHP yourself, for example to build or test websites on your own computer. Then you have a copy to update, like any other software.
What does a PHP vulnerability mean, explained simply?
A vulnerability is a weakness in software that someone could use to make it do something it shouldn't. The PHP project describes the October 2026 flaws as allowing "unauthenticated remote code execution". In plain terms, someone could make a server run instructions of their choosing without logging in first.
The PHP project's answer is to update. Its release notes say "There are no complete mitigations, updating is the only safe choice." If you look after a website, the first step is finding which version it runs: how to check your website's PHP version shows where to look and lists the fixed releases.
More questions
Is PHP a virus or a program on my computer?
No. PHP is a programming language and the software that runs it, not malware. It runs on the servers that host websites. To see whether your own computer has a copy, our guide do I have PHP installed? shows the one command to run.
What does PHP stand for?
The PHP manual says the name is a recursive acronym for "PHP: Hypertext Preprocessor". Recursive means the first word of the expansion is the name itself. The "preprocessor" part reflects what it does: it works on a page before the page is sent to your browser.
Who decides which PHP version my website uses?
Usually your hosting company. WordPress's guide to updating PHP says "Your hosting company determines which versions of PHP are available for your site", and that many hosts let you change it yourself. Our guide to checking your website's PHP version shows where to look.
Can I tell if a website uses PHP?
Often you can't. The PHP manual says a server can be configured so that there's no way for users to tell PHP is being used. If you run the site, your hosting control panel or your host will tell you the version.
Is PHP safe to use?
It depends on the version a site runs: supported versions get security fixes, and versions past end of life don't. Our guide is PHP safe? explains how PHP's support works.