What Is PHP, why is everyone talking about it?

PHP is behind a large part of the internet, but a serious security flaw in the programming language has suddenly brought it into the spotlight. The vulnerability, rated 9.2 out of 10 for severity, prompted website operators and government agencies to rush to secure their systems, with some websites temporarily going offline.

The issue has raised concerns about the security of the technology powering millions of websites and how a flaw that had existed for years went undetected.

What is PHP, and what does it do?

The PHP programming language is an open-source language used to construct and run websites. It works behind the scenes to assist websites in processing data, communicating with databases and displaying information whenever a webpage is accessed by users.

For instance, PHP could be used for managing website functions such as login systems, online shopping carts and contact forms, among others. PHP is widely used in website management platforms like WordPress, where website publishers can manage their sites without coding every feature from scratch.

A cybersecurity firm, Wiz, estimates that approximately 70% of all websites use PHP, while statistics compiled by W3Techs put the number at roughly 75%. This makes it quite dangerous whenever there is a security issue since the impact may be felt far and wide.

Researchers from cybersecurity companies Calif and Wiz identified two vulnerabilities in PHP while working through an OpenAI programme designed to uncover security weaknesses across the internet.

The flaws affect memory management and error handling, which are essential parts of how PHP operates. According to the researchers, the weaknesses could potentially allow attackers to exploit a website, access sensitive information or alter its content.

The vulnerabilities had reportedly existed for more than a decade. The PHP Foundation acknowledged that a possible exploit had been theorised in 2024, although researchers had not established a concrete way to carry it out at the time.

How serious is the PHP security flaw?

The vulnerabilities were scored as 9.2 out of 10 using the Common Vulnerability Scoring System and thus classified as critical.

Exploiting the vulnerabilities would put the websites at risk of unauthorised access, theft of information, malware installation, and content deletion. This is a serious issue since PHP is widely used on the web.

In addition, the vulnerability poses a more general problem of internet security, as a flaw in commonly-used infrastructure can impact companies operating in a number of countries and sectors.

The PHP Foundation announced the necessary security updates and advised website administrators to implement them as soon as possible. Government authorities also issued the warnings; in particular, some of them recommended bringing websites down until the patching was done.

Some government websites in Canada, France, and Japan were reportedly brought down because of that.