What is PHP? | PHP Explained

What is PHP?

PHP (PHP: Hypertext Preprocessor) is a free, open-source scripting language that runs on a web server to build web pages and applications. Created by Rasmus Lerdorf in 1994 and released publicly in June 1995, it is now used by around 69% of websites whose server-side language is known, including those built on WordPress, Drupal and Joomla.

How does PHP work?

PHP runs on the web server, not in the visitor’s browser, and it often works with a database to build each page at the moment it is requested. This is what lets a site show up-to-date content, such as stock levels, account details or the latest posts, without anyone editing a page by hand.

When someone visits a PHP page, the process includes five steps:

1. The request: A visitor types a web address or clicks a link, and their browser sends a request to the website’s server.
2. The web server: A web server such as Apache or Nginx receives the request. If it is for a PHP file, the server passes it to the PHP interpreter, the software that reads and runs PHP code. PHP handles each request using a worker, and a server has a limited number of them.
3. Code execution: PHP runs the instructions in the file. It might query a database, process a form, calculate a total or check a user’s login details.
4. The output: PHP produces the finished page, usually as HTML, which the browser reads together with the CSS and JavaScript the page links to.
5. The response: The server sends this result back to the browser, which displays the page. The visitor only ever sees the finished output, never the PHP code behind it.

Because PHP code runs on the server itself, a weakness in PHP can affect the server and not just the website. That is why keeping PHP up to date matters, and why vulnerabilities such as PHP2Shell are taken so seriously.

What is PHP used for?

PHP is used wherever a website needs to build pages dynamically, and much of what people know as “the web” runs on it. Typical uses include:

• Content management systems: WordPress, Drupal and Joomla are all built on PHP. WordPress is the largest, and sites built on these platforms inherit the PHP version running on their server.
• Online shops: eCommerce platforms such as Magento, and WooCommerce on WordPress, use PHP to handle products, baskets, customer accounts and orders.
• Web applications: Frameworks such as Laravel and Symfony give developers a structured way to build customer portals, booking systems, dashboards and APIs.
• Wikis, intranets and internal tools: PHP also runs software that sits inside company networks, as well as public sites. MediaWiki, which powers Wikipedia, is one example.
• Software and devices that embed PHP: PHP is also found in developer tools and command-line packages, and in components of some network and storage devices, so it can be present even where nobody has chosen it as a web language.

We host a wide range of these platforms, including WordPress and eCommerce platforms such as Magento and WooCommerce, on infrastructure designed for demanding, high-traffic sites.

Because so many systems are built on PHP, the version running on your server matters as much as the application on top of it, which is what the sections below cover.

What are the benefits and limitations of PHP?

Benefits

• Free and open source: Anyone can use PHP without licence fees, and the language is maintained by an active community and the PHP Foundation.
• Large ecosystem: The content management systems, eCommerce platforms, frameworks and libraries built on PHP mean that developers rarely start from scratch.
• Wide hosting support: Almost every hosting provider supports PHP, which makes it straightforward to deploy and to move between providers.
• Database compatibility: PHP connects easily to databases, so sites can build pages from live data.
• Continued development: The language has a new release every year, and PHP 7 in 2015 and PHP 8 in 2020 brought significant performance improvements and new features.
• Easy to get started: It is relatively approachable for new developers, which has helped build a large pool of skills.

Limitations

• Security depends on the version you run: Older versions stop receiving security fixes, and around 34% of PHP sites measured by W3Techs in October 2026 were still on PHP 7 or earlier (derived from 65.7% of PHP sites using PHP 8). That leaves many sites with no official support.
• It is memory-unsafe: Like many of the older technologies, PHP is written in a language that can leave software open to memory-related flaws. PHP2Shell is an example.
• Its popularity makes it a target: Because PHP runs so much of the web, attackers can scan for it at scale, so unpatched systems are found quickly.
• Resources can run out: Each visitor request uses a PHP worker, so high traffic or limited server resources can use them all up and take a site offline. Sites need enough resources for the traffic they receive.
• Third-party code varies in quality: Plugins, themes and extensions can introduce a host of issues if not vetted and regularly updated.
• Newer languages are gaining ground: It is becoming more common for developers to choose newer languages for new projects, although PHP remains the most widely used server-side language on the web.

None of these limitations is a reason to avoid PHP. They are a reason to keep it supported and up to date.

Which PHP versions are supported?

PHP releases a new version every year, and usually receives two years of active bug fixes followed by a further two years of security-only support. Once that ends, the version no longer gets updates from the PHP project, making for a four-year lifecycle. The dates below come from PHP’s supported versions page.

The current dates are:

• PHP 8.5: active support until the 31st of December 2027, with security fixes until the 31st of December 2029.
• PHP 8.4: active support until the 31st of December 2026, with security fixes until the 31st of December 2028.
• PHP 8.3: security fixes only, until the 31st of December 2027.
• PHP 8.2: security fixes only, until the 31st of December 2026.
• PHP 8.1 and earlier: no longer supported. Security support for PHP 8.1 ended on the 31st of December 2025.

Why does support matter?

When a flaw is found, only supported versions receive an official fix. PHP2Shell showed the difference. PHP released fixes for 8.2, 8.3, 8.4 and 8.5, while older branches received no official release, only minimal source backports from the PHP security team. AlmaLinux also patched versions that had reached the end of their Red Hat Enterprise Linux life cycle, but said future fixes for those versions are not guaranteed.

How do you check your PHP version?

A good start is to list every server, site and container that runs PHP, including developer and staging environments. On a server, running “php -v” shows the version. It is important to bear in mind that vendor-patched packages can keep an older version number whilst containing the fix, so check your vendor’s security advisory and package version, not just the number PHP reports. With managed hosting, you can ask your provider to confirm the version and patch status for you. If your hosting uses a control panel such as cPanel or Plesk, it provides a platform for running PHP, pushes out updates and gives you an interface to select and install newer PHP versions yourself.

What should you do?

Plan to move to the newest version your applications support. With PHP 8.2 security support ending on the 31st of December 2026, anyone still on this version has about two months. Test your applications, plugins and themes against the new version first, as sometimes older code can break on a major upgrade.

PHP’s official website publishes migration guides for each supported version, which explain what changes between releases and are a useful starting point when planning an upgrade.

Other software on the server needs to keep pace too. Web server software such as Apache, Nginx and LiteSpeed can affect a PHP upgrade and sometimes stops sites working if it is out of date, so include it in your plan and test before you switch.

PHP has also indicated that further patches may follow. Only supported versions receive official fixes, so moving to one now means you are ready to apply them as they arrive.

What is PHP2Shell, and does it affect your site?

Last updated 29 October 2026. This situation is still developing.

PHP2Shell is the name given to two critical vulnerabilities in PHP itself, CVE-2026-109618 and CVE-2026-109619, which PHP fixed on the 21st of October 2026. Each is rated 9.2 on the CVSS v4.0 scale, which is a standardised framework used to measure and communicate the severity of computer system vulnerabilities. Both can allow remote code execution, which means an attacker can run commands on a server without a password and without any action from the user.

Who is affected?

According to AlmaLinux, any website or application running PHP could be affected if it has not been updated to a fixed version: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Older versions are affected too, and have no official fix.

This includes sites built on WordPress, Drupal and Joomla. The flaw is in PHP itself, so updating your CMS alone does not fix it entirely. PHP is also built into some other software, so it’s worth asking your suppliers too.

What has happened so far?

• Attackers began trying to exploit the flaws before the fix was released. Amazon recorded an attempt on the 17th of October.
• On the 21st of October PHP released the fixes, and the UK NCSC and CISA urged organisations to update immediately.
• According to GBHackers, security firms have recorded hundreds of thousands of attempts, although some come from defenders testing for the flaw.
• On the 24th of October, researchers confirmed attackers running commands on test servers set up to attract them. These servers were running an unpatched version, PHP 8.4.26.
• On the 26th of October, CISA added both flaws to its Known Exploited Vulnerabilities catalogue after confirming exploitation, and gave US federal agencies until the 29th of October to fix them. CISA has not said which organisations were affected, and as of the 29th of October it is not yet clear how many real systems have been compromised.
• PHP has indicated that further patches may follow, including a full advisory for a related issue, CVE-2026-115560, with its next regular release. This is another reason to move to a supported version.

How can we help you upgrade?

We can support you through the PHP upgrade process. Regular patch management reduces the risk of running legacy versions of applications and helps to mitigate vulnerabilities such as PHP2Shell. If we find an issue while patching, we highlight it so it can be investigated, and then help to resolve it. You can raise a ticket at any time to get support with this.

We can support patching of all versions for which updates are available. For legacy PHP versions, we rely on the updates provided by the software repositories, so we cannot resolve problems that come from running a version that no longer receives fixes. In this situation we encourage moving to a supported version, and we can provide migration support for this.

How do you check and patch PHP?

Keeping PHP patched is a routine job, and it’s easier when it follows the same few steps each time:

1. List everything that runs PHP, including live sites, development and staging copies, and containers.
2. Check the version of each. If you use a hosting provider, ask them to confirm it.
3. Update to the latest release of a supported version, or your provider’s patched package. Where a vendor has patched on an older version, the version number may not change, so check its security advisory. If you use cPanel or Plesk, select and install the newer version from the control panel.
4. Restart the web server or PHP service, so the update takes effect. Rebuild and redeploy any containers from patched images.
5. Update plugins, themes and extensions, and remove any you no longer use.
6. Ask suppliers about third-party products that include PHP, such as developer tools and some network or security devices.
7. Check the rest of the software stack. Web server software such as Apache, Nginx and LiteSpeed may also need updating, as it can affect a PHP upgrade and sometimes causes sites to stop working. Test each site after upgrading.
8. Watch for unusual activity afterwards. If using managed hosting, ask your provider to look for unexpected processes and traffic on the server or servers. 

How do you keep a PHP site secure?

Good security comes from steady habits:

• Run a supported version, and plan upgrades before official support ends.
• Patch promptly, starting with systems that face the internet.
• Keep your CMS, plugins and themes up to date, since each can carry its own weaknesses.
• Limit access. Give people and applications only the access they need, and use multi-factor authentication on administrator accounts.
• Monitor your sites, so unusual activity is spotted early.
• Keep tested backups, including a copy stored separately from your live environment.

Our insight on cyber security essentials covers these basics in more detail.

Is PHP still worth using?

For most organisations, yes. According to W3Techs, PHP is used by 69.2% of websites whose server-side language is known, it is actively developed with a new release each year, and it supports platforms such as WordPress, Drupal and Magento. The biggest risk you control is running an unsupported or unpatched version, although PHP2Shell shows that even supported versions need updating promptly when a serious flaw is found.

It’s fair to note that memory safety is a growing concern across the industry. CISA and the NSA note that memory safety flaws account for roughly 66% to 75% of vulnerabilities across major platforms, which is why they encourage a gradual move towards memory-safe languages, and some teams now choose them for new projects. For an existing PHP site, rewriting the application is rarely the first step. Staying on a supported version, keeping it patched and planning to modernise older applications is usually a more practical path.

If you are considering whether to move away from PHP, or update your infrastructure in any other way to reduce the risk of impact from any future vulnerabilities, you may benefit from a consultation with a technician or solutions architect.

Why do PHP sites go down?

PHP is one of the most common causes of sites going down, and the cause is often capacity and not an attack. A PHP site handles each visitor request using a limited number of workers. When traffic is high, or the server has too few resources, all the workers can be busy at once, so new visitors wait, the site slows and may stop responding.

Make sure your hosting has enough resources to support your site’s needs, including peak traffic, and monitor how many workers are in use so you can add capacity before they run out.

How can managed hosting help?

Looking after PHP means tracking versions, applying patches, testing changes and monitoring for problems, which can take time and specialist knowledge. A managed hosting provider can take on much of that, including:

• Version management: Knowing which PHP version each site runs, and planning upgrades before support ends.
• Patching: Applying updates promptly and restarting services.
• Monitoring: Watching for unusual activity, around the clock.
• Resource planning: Making sure your hosting has enough resources for your site’s traffic, so PHP workers do not max out.
• Support: Engineers on hand when something changes or goes wrong.

The division of responsibilities varies between services. For example, plugins and application code often remain with the customer unless agreed otherwise, so ask for it in writing. We host WordPress, Drupal, Magento and other platforms, providing hosting for any CMS you choose, with 24/7/365 monitoring and support from our engineers. Our application and patch management service covers most of this, including version management and patching, and we support you through PHP upgrades when you raise a ticket.

The next steps

PHP remains the engine behind much of the web, and keeping it supported and patched is one of the most effective ways to protect a site. If you aren’t sure which PHP versions your sites run, or you would like help with patching and upgrades, speak to one of our Cloud Consultants about your requirements, or explore our CMS hosting page.

FAQs

What does PHP stand for?
PHP stands for “PHP: Hypertext Preprocessor”. It is a recursive acronym, and it originally stood for “Personal Home Page”.

Is PHP the same as WordPress?
No. PHP is a programming language, whilst WordPress is a content management system (CMS) written in PHP. A WordPress site runs on PHP, so it depends on the PHP version on its server as well as on WordPress updates.

Which PHP version should I use?
A supported version, ideally the newest one your applications work with. As of the 29th of October 2026, PHP 8.2 to 8.5 are supported, security support for PHP 8.2 ends on the 31st of December 2026, and PHP 8.1 and earlier are no longer supported.

Is PHP2Shell fixed?
PHP fixed PHP2Shell on the 21st of October 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. A system is only protected once it has been updated and restarted. Older versions have no official release, so they should be upgraded or patched through a vendor.

Is my WordPress site affected?
It could be. WordPress runs on PHP, so a site is exposed if its server runs a PHP version that has not been patched. Updating WordPress does not fix PHP2Shell, so check the PHP version with your hosting provider and update it.

Can Hyve help me upgrade PHP?
Yes. Hyve Managed Hosting can support customers through PHP upgrades, highlight any issues found during patching and help resolve them, and customers can raise a ticket to get support. For legacy PHP versions, it relies on updates provided by the software repositories, so it cannot resolve problems caused by running a version that no longer receives fixes.

Why does my PHP site keep going down?
A common cause is running out of PHP workers. When traffic is high or the server has too few resources, all workers can be busy at once, and the site slows or stops responding. Check that your hosting has enough resources for your traffic, and ask your provider to monitor worker usage.