Why is everybody speaking about PHP’s ‘essential’ safety flaws?
So what’s PHP? And does it have an effect on you? Right here’s what you might want to know.
What’s PHP?
PHP is named a general-purpose scripting language usually utilized in internet improvement. Run on a server, it permits web sites to deal with advanced actions with out having to embed directions or content material inside pages. Examples of dynamically generated output embody displaying the present calendar date, HTML and PDFs, and even JSON and XML information for caching functions.
Many web sites use server-side languages to serve content material, and of people who do, some sources (like W3Techs) estimate that just about 70 % depend on PHP. Throughout the broader web, W3Techs believes round 40 % of all web sites (yep, all!) run on WordPress—a serious adopter of PHP.
Why did PHP blow up within the information?
On October 20, 2026, the PHP Group (which maintains PHP) launched an alert for coming safety updates, designed to patch two very high-risk vulnerabilities later named as CVE-2026-109618 and CVE-2026-109619. Each allow an attacker to run distant code, carry a severity score of 9.2 of 10, and have an effect on “all PHP installations serving internet requests,” in keeping with the PHP Group.
The advisory set off a flurry throughout the net, with server directors hurriedly making ready for the patched variations of PHP. When particulars of the 2 vulnerabilities launched the subsequent day on October 21, websites throughout the net started going offline briefly as PHP upgrades had been accomplished—together with authorities web sites within the Netherlands, France, and Germany.
Why is that this a giant deal?
Two principal causes: The variety of affected websites, and how briskly vulnerabilities can now be exploited.
