PHP in plain English
PHP stands for "PHP: Hypertext Preprocessor" and is a programming language for web applications. The code runs on the server, not in the browser: when someone opens a page, the web server executes the PHP script, retrieves product data from a database, for example, and sends finished HTML back to the browser. Visitors never see the PHP code itself.
Think of a restaurant kitchen: the guest places an order, the kitchen prepares the dish according to a recipe, and only the finished plate is served. The order corresponds to the request, the recipe to the PHP script, and the plate to the finished page. How well this works depends on the recipe – and on the condition of the kitchen itself.
According to the security company Wiz, PHP runs on around 70 percent of all websites (Wiz Research). Attackers are correspondingly interested in vulnerabilities in PHP applications and in PHP itself.
How PHP works
The PHP runtime sits between the web server and the PHP code. It can be connected in different ways, for example as an Apache module (mod_php) or as a separate service (PHP-FPM) that receives requests from the web server through an interface. In both cases, so-called workers process many requests one after another. How PHP behaves is defined in the php.ini configuration file – for example, how much memory a script may use or whether error messages appear in the browser.
The PHP project maintains each release branch for four years: two years with all bug fixes, followed by two more years with fixes for critical security issues only. After that, the branch receives no further updates and has reached its end of life. In October 2026, branches 8.2 through 8.5 are supported; security updates for PHP 8.2 end on December 31, 2026 (PHP: Supported Versions).
A practical example
A fictional scenario: in addition to its main website, a machinery manufacturer runs an older dealer portal that an agency built in PHP years ago. The portal runs on a separate server with PHP 7.4, which has received no updates since the end of 2022. Nobody feels responsible because the site still works.
A vulnerability assessment flags the server: the outdated PHP version is affected by publicly known vulnerabilities, and an upload form for dealer documents checks files only superficially. An attacker could have used it to execute code on the server and obtain the dealers' credentials. The company migrates the portal to a supported PHP version and has the upload form retested after the rebuild.
Why does this matter for businesses?
Vulnerabilities arise on two levels. Most of them are in application code: SQL injection, cross-site scripting, insecure file uploads, the inclusion of foreign files through manipulated paths, or insecure deserialization with the PHP function unserialize(). Extensions and plugins further enlarge the attack surface. In the worst case, such flaws lead to remote code execution, meaning a takeover of the server.
Less common but particularly serious are vulnerabilities in the PHP runtime itself. They affect every application on the server, even if its code is flawless. One example is the php2shell vulnerabilities disclosed in 2026, which allow attackers to execute code without authentication. Anyone running outdated PHP versions is left without a fix for such flaws. On top of that, many PHP installations sit unnoticed in appliances, management interfaces, or forgotten project servers.
How to protect your organization
- Use supported versions: Only run PHP branches that still receive security updates, and plan migrations well before the end of life.
- Apply updates quickly: Security updates for PHP belong in your patch management. Restart every PHP process after an update.
- Know your inventory: Record every system that runs PHP – including containers, hosting packages, and vendor products.
- Harden the configuration: Turn off error messages in the browser, hide the version in the HTTP header, disable functions and extensions you don't need, and set tight limits for uploads. Learn more under system hardening.
- Code securely: Prepared statements against SQL injection, consistent escaping of all output, and strict validation of uploaded files belong in every PHP application.
- Test regularly: Penetration tests and code reviews find vulnerabilities in PHP applications before attackers do.
How Rootsektor can help
In our web application penetration tests, we examine PHP applications for typical vulnerabilities – from injection flaws and file uploads to errors in access control. With a code review, we analyze the source code directly. A vulnerability assessment shows where outdated PHP versions are running in your infrastructure.