Why is everybody speaking about PHP’s ‘essential’ safety flaws?

So what’s PHP? And does it have an effect on you? Right here’s what you’ll want to know.

What’s PHP?

PHP is named a general-purpose scripting language typically utilized in net growth. Run on a server, it permits web sites to deal with advanced actions with out having to embed directions or content material inside pages. Examples of dynamically generated output embody exhibiting the present calendar date, HTML and PDFs, and even JSON and XML recordsdata for caching functions.

Many web sites use server-side languages to serve content material, and of those who do, some sources (like W3Techs) estimate that just about 70 % depend on PHP. Throughout the broader web, W3Techs believes round 40 % of all web sites (yep, all!) run on WordPress—a serious adopter of PHP.

Why did PHP blow up within the information?

On October 20, 2026, the PHP Group (which maintains PHP) launched an alert for coming safety updates, designed to patch two very high-risk vulnerabilities later named as CVE-2026-109618 and CVE-2026-109619. Each allow an attacker to run distant code, carry a severity score of 9.2 of 10, and have an effect on “all PHP installations serving net requests,” in accordance with the PHP Group.

The advisory set off a flurry throughout the net, with server directors hurriedly getting ready for the patched variations of PHP. When particulars of the 2 vulnerabilities launched the following day on October 21, websites throughout the net started going offline briefly as PHP upgrades have been accomplished—together with authorities web sites within the Netherlands, France, and Germany.

Why is that this a giant deal?

Two fundamental causes: The variety of affected websites, and how briskly vulnerabilities can now be exploited.