40 pages

PHP knowledge: the programming language explained

What PHP is, how it generates a web page and why operating mode, configuration and version decide security. Clear for decision-makers, in depth for admins and developers.

WhatsApp emergency

What Is PHP? The Programming Language Explained

PHP is a scripting language that runs on the server and generates HTML there. Many CMS and shop systems are built on it, so a flaw in PHP affects a very large number of websites.

The History of PHP: From 1994 to Today

From a private tool for a résumé page to the foundation of many CMS and shop systems: the key milestones in the history of PHP, with verified dates.

How PHP Generates a Web Page: The Path of a Request

What happens between the click and the finished page: web server, SAPI, compiler, OPcache and Zend VM in seven steps, and why PHP2Shell targets exactly this process.

The Zend Engine: The Heart of PHP

The Zend Engine compiles PHP code into opcodes and executes it. Knowing its building blocks explains why flaws in the core such as PHP2Shell are fixed only by a PHP update.

OPcache Explained: PHP's Bytecode Cache

OPcache keeps compiled PHP code in shared memory. This saves processing time but demands care with deployments, restarts and on servers with several customers.

SAPI Explained: How PHP Talks to the Web Server

The SAPI is the interface between PHP and the web server. It determines how requests arrive, which php.ini applies and what has to restart after an update.

PHP-FPM Explained: Process Manager, Pools and Workers

PHP-FPM runs PHP as its own service with pools and workers. How the process model works, which directives matter and why workers must restart after updates.

mod_php Explained: PHP Inside the Apache Process

With mod_php, PHP sits inside every Apache process. That is simple but inflexible, and after PHP2Shell it is the riskiest operating mode. How it works and how to recognise it.

CGI and FastCGI: The Basics

CGI starts a process for every request, FastCGI keeps processes alive. What that means for PHP, php-cgi and PHP-FPM and which settings affect security.

PHP on the Command Line (CLI)

The PHP CLI runs scripts without a web server, for example for cron jobs and maintenance. It behaves differently from the web version and often does not show the state your website uses.

The php.ini Explained: Structure, Levels and Precedence

Where PHP finds its settings, in which order they apply and who may override them. The basis for any hardening and for the interim measures for PHP2Shell.

PHP Versions and the Release Cycle

A new PHP version is released every November and maintained for four years. Which branches end when, and what that means for your planning after PHP2Shell.

PHP 8.0 to 8.5: The Most Important New Features

From match and JIT in PHP 8.0 to the pipe operator and URI extension in PHP 8.5: the new features of each version, the pitfalls when upgrading and what they bring for security.

Understanding PHP Extensions

Extensions bring database drivers, encryption or caches into PHP. How the types differ, how to load and check them, and what they mean for updates and hardening.

Composer: The Package Manager for PHP

Composer downloads and manages the libraries on which modern PHP projects are built. Anyone who understands composer.json, composer.lock and the autoloader deploys reproducibly and more securely.

PHP Frameworks at a Glance

Frameworks give PHP applications structure, routing and security building blocks. This overview shows the well-known frameworks, selection criteria and the limits of their protection.

Which CMS and Shop Systems Run on PHP

Many well-known CMS, shops and business applications run on PHP. How to judge which of your websites may be affected by PHP flaws such as PHP2Shell.

PHP and Databases: PDO and mysqli

PHP talks to databases through PDO or mysqli. Here you will see the differences, secure queries with prepared statements and what to do about database credentials after a server incident.

Sessions and Cookies in PHP

Sessions turn stateless HTTP into a login that lasts across several pages. Here is how PHP handles this internally, which defaults apply and what session.upload_progress has to do with PHP2Shell.

Superglobals: $_GET, $_POST, $_FILES and More

Superglobals are the arrays through which PHP code gets at request data. Knowing how PHP fills them and which limits apply leads to safer code and a better understanding of PHP2Shell.

How PHP Processes File Uploads

Between the click on Upload and your code lies a whole processing chain inside PHP. This page explains multipart/form-data, temporary files, $_FILES, limits and the link to PHP2Shell.

The PHP Type System

PHP is dynamically typed but has gained an ever stricter type system since PHP 7. Here you see the types, the key versions and why strict comparisons prevent security bugs.

PHP knows both classic error messages and exceptions. This page explains the Throwable hierarchy, clean error handling, safe production settings and the PHP2Shell measure concerning fatal_error_backtraces.

Object-Oriented Programming in PHP

Modern PHP applications are almost always object-oriented. This page explains the building blocks, the new features of PHP 8.0 to 8.4 and why magic methods matter for security.

Namespaces and Autoloading (PSR-4)

Namespaces organise PHP code; autoloading loads classes exactly when they are needed. Here you see how PSR-4 maps class names to files and why the autoloader must be checked after an incident.

PSR Standards of the PHP-FIG

PSRs are shared standards that many PHP projects have agreed on. This page lists all PSRs with their status and shows which ones count in everyday work and where they touch on security.

Memory Management in PHP: Reference Counting and Garbage Collection

PHP manages memory with reference counting and a garbage collector for cycles. This page explains the mechanics, the key measuring functions and why both PHP2Shell vulnerabilities involve memory states.

memory_limit and Out-of-Memory: What Happens Inside

What happens when a PHP script hits memory_limit? The mechanics, the new hard memory limit since the October patches and the link to CVE-2026-109618.

The Request Lifecycle: Startup, Execution, Shutdown

How PHP starts processes, handles requests and cleans up in between. With the phases MINIT to MSHUTDOWN and the link to CVE-2026-109619.

JIT and Performance in PHP 8

Since 8.0, the JIT compiler translates PHP into machine code. For typical websites it adds little; OPcache, current versions and clean configuration deliver more.

Testing PHP Code: PHPUnit and Pest

PHPUnit is the standard testing tool for PHP, and Pest builds on it. Anyone with tests can apply security updates and version changes faster and with less risk.

Static Analysis: PHPStan and Psalm

PHPStan and Psalm find errors in PHP code without executing it. Psalm additionally traces unsafe data flows. Neither finds vulnerabilities in the PHP interpreter itself.

Built-in Security Functions of PHP

PHP ships with secure building blocks for passwords, random values, escaping, cryptography and sessions. Anyone who uses them consistently avoids the most common application errors.

Local PHP Development: Docker, DDEV and More

For local PHP development there is the built-in web server, official Docker images and tools such as DDEV. What matters is that the same PHP version runs locally as in production.

PHP Compared with Node.js, Python and Java

PHP, Node.js, Python and Java differ mainly in execution model and operation. No language is inherently more secure; what matters is maintenance and the patch process.

How the PHP Project Handles Security Vulnerabilities

Vulnerabilities in PHP are reported confidentially, rated, fixed in a release and published as a GitHub security advisory. PHP2Shell shows the process in an emergency.

Compiling PHP from Source Code

PHP can be built yourself with configure and make. This gives control over extensions and options, but also full responsibility for every security update.

Running PHP in Containers

PHP in a container needs the right image variant, a production configuration, sensible memory limits and a process that rebuilds images with every security release.

The Future of PHP

PHP is developed according to fixed rules: four years of support per version, PHP 8.6 is planned for 19 November 2026, and there are accepted RFCs for PHP 9.0 but no date.

PHP Basics for Admins

What admins need to know about PHP: which binaries run, how configuration takes effect, how FPM pools work and which commands help with updates such as the one for PHP2Shell.

Immediate contact

Every hour counts. Write to us now.

Briefly describe your system, PHP version and observation. We will get back to you, clarify the situation and work remotely until the incident is closed and documented.

WhatsApp emergency Call