# PHP knowledge: the programming language explained > PHP explained clearly: history, Zend Engine, SAPI, PHP-FPM, mod_php, php.ini, versions, Composer, sessions, uploads, memory and security. Source: https://phpsos.de/en/php/ As of: 25/10/2026 Provider: PHP SOS, PHP emergency help and server security. Immediate help via WhatsApp: https://wa.me/491736494914?text=Hello%20PHP%20SOS%2C%20we%20need%20help%20with%20our%20PHP%20server.%20Company%3A%20%E2%80%A6%20Website%3A%20%E2%80%A6 What PHP is, how it generates a web page and why operating mode, configuration and version decide security. Clear for decision-makers, in depth for admins and developers. - [What Is PHP? The Programming Language Explained](https://phpsos.de/en/php/was-ist-php/): PHP is a scripting language that runs on the server and generates HTML there. Many CMS and shop systems are built on it, so a flaw in PHP affects a very large number of websites. - [The History of PHP: From 1994 to Today](https://phpsos.de/en/php/geschichte-von-php/): From a private tool for a résumé page to the foundation of many CMS and shop systems: the key milestones in the history of PHP, with verified dates. - [How PHP Generates a Web Page: The Path of a Request](https://phpsos.de/en/php/wie-php-funktioniert/): What happens between the click and the finished page: web server, SAPI, compiler, OPcache and Zend VM in seven steps, and why PHP2Shell targets exactly this process. - [The Zend Engine: The Heart of PHP](https://phpsos.de/en/php/zend-engine/): The Zend Engine compiles PHP code into opcodes and executes it. Knowing its building blocks explains why flaws in the core such as PHP2Shell are fixed only by a PHP update. - [OPcache Explained: PHP's Bytecode Cache](https://phpsos.de/en/php/opcache/): OPcache keeps compiled PHP code in shared memory. This saves processing time but demands care with deployments, restarts and on servers with several customers. - [SAPI Explained: How PHP Talks to the Web Server](https://phpsos.de/en/php/sapi-erklaert/): The SAPI is the interface between PHP and the web server. It determines how requests arrive, which php.ini applies and what has to restart after an update. - [PHP-FPM Explained: Process Manager, Pools and Workers](https://phpsos.de/en/php/php-fpm-erklaert/): PHP-FPM runs PHP as its own service with pools and workers. How the process model works, which directives matter and why workers must restart after updates. - [mod_php Explained: PHP Inside the Apache Process](https://phpsos.de/en/php/mod-php-erklaert/): With mod_php, PHP sits inside every Apache process. That is simple but inflexible, and after PHP2Shell it is the riskiest operating mode. How it works and how to recognise it. - [CGI and FastCGI: The Basics](https://phpsos.de/en/php/cgi-und-fastcgi/): CGI starts a process for every request, FastCGI keeps processes alive. What that means for PHP, php-cgi and PHP-FPM and which settings affect security. - [PHP on the Command Line (CLI)](https://phpsos.de/en/php/php-cli/): The PHP CLI runs scripts without a web server, for example for cron jobs and maintenance. It behaves differently from the web version and often does not show the state your website uses. - [The php.ini Explained: Structure, Levels and Precedence](https://phpsos.de/en/php/php-ini-erklaert/): Where PHP finds its settings, in which order they apply and who may override them. The basis for any hardening and for the interim measures for PHP2Shell. - [PHP Versions and the Release Cycle](https://phpsos.de/en/php/release-zyklus/): A new PHP version is released every November and maintained for four years. Which branches end when, and what that means for your planning after PHP2Shell. - [PHP 8.0 to 8.5: The Most Important New Features](https://phpsos.de/en/php/php-8-neuerungen/): From match and JIT in PHP 8.0 to the pipe operator and URI extension in PHP 8.5: the new features of each version, the pitfalls when upgrading and what they bring for security. - [Understanding PHP Extensions](https://phpsos.de/en/php/php-erweiterungen/): Extensions bring database drivers, encryption or caches into PHP. How the types differ, how to load and check them, and what they mean for updates and hardening. - [Composer: The Package Manager for PHP](https://phpsos.de/en/php/composer/): Composer downloads and manages the libraries on which modern PHP projects are built. Anyone who understands composer.json, composer.lock and the autoloader deploys reproducibly and more securely. - [PHP Frameworks at a Glance](https://phpsos.de/en/php/php-frameworks/): Frameworks give PHP applications structure, routing and security building blocks. This overview shows the well-known frameworks, selection criteria and the limits of their protection. - [Which CMS and Shop Systems Run on PHP](https://phpsos.de/en/php/cms-und-shops-auf-php/): Many well-known CMS, shops and business applications run on PHP. How to judge which of your websites may be affected by PHP flaws such as PHP2Shell. - [PHP and Databases: PDO and mysqli](https://phpsos.de/en/php/php-und-datenbanken/): PHP talks to databases through PDO or mysqli. Here you will see the differences, secure queries with prepared statements and what to do about database credentials after a server incident. - [Sessions and Cookies in PHP](https://phpsos.de/en/php/sessions-und-cookies/): Sessions turn stateless HTTP into a login that lasts across several pages. Here is how PHP handles this internally, which defaults apply and what session.upload_progress has to do with PHP2Shell. - [Superglobals: $_GET, $_POST, $_FILES and More](https://phpsos.de/en/php/superglobals/): Superglobals are the arrays through which PHP code gets at request data. Knowing how PHP fills them and which limits apply leads to safer code and a better understanding of PHP2Shell. - [How PHP Processes File Uploads](https://phpsos.de/en/php/datei-uploads-intern/): Between the click on Upload and your code lies a whole processing chain inside PHP. This page explains multipart/form-data, temporary files, $_FILES, limits and the link to PHP2Shell. - [The PHP Type System](https://phpsos.de/en/php/typsystem/): PHP is dynamically typed but has gained an ever stricter type system since PHP 7. Here you see the types, the key versions and why strict comparisons prevent security bugs. - [Errors and Exceptions in PHP](https://phpsos.de/en/php/fehler-und-exceptions/): PHP knows both classic error messages and exceptions. This page explains the Throwable hierarchy, clean error handling, safe production settings and the PHP2Shell measure concerning fatal_error_backtraces. - [Object-Oriented Programming in PHP](https://phpsos.de/en/php/objektorientierung/): Modern PHP applications are almost always object-oriented. This page explains the building blocks, the new features of PHP 8.0 to 8.4 and why magic methods matter for security. - [Namespaces and Autoloading (PSR-4)](https://phpsos.de/en/php/namespaces-autoloading/): Namespaces organise PHP code; autoloading loads classes exactly when they are needed. Here you see how PSR-4 maps class names to files and why the autoloader must be checked after an incident. - [PSR Standards of the PHP-FIG](https://phpsos.de/en/php/psr-standards/): PSRs are shared standards that many PHP projects have agreed on. This page lists all PSRs with their status and shows which ones count in everyday work and where they touch on security. - [Memory Management in PHP: Reference Counting and Garbage Collection](https://phpsos.de/en/php/speicherverwaltung/): PHP manages memory with reference counting and a garbage collector for cycles. This page explains the mechanics, the key measuring functions and why both PHP2Shell vulnerabilities involve memory states. - [memory_limit and Out-of-Memory: What Happens Inside](https://phpsos.de/en/php/out-of-memory/): What happens when a PHP script hits memory_limit? The mechanics, the new hard memory limit since the October patches and the link to CVE-2026-109618. - [The Request Lifecycle: Startup, Execution, Shutdown](https://phpsos.de/en/php/request-lebenszyklus/): How PHP starts processes, handles requests and cleans up in between. With the phases MINIT to MSHUTDOWN and the link to CVE-2026-109619. - [JIT and Performance in PHP 8](https://phpsos.de/en/php/jit-und-performance/): Since 8.0, the JIT compiler translates PHP into machine code. For typical websites it adds little; OPcache, current versions and clean configuration deliver more. - [Testing PHP Code: PHPUnit and Pest](https://phpsos.de/en/php/php-testen/): PHPUnit is the standard testing tool for PHP, and Pest builds on it. Anyone with tests can apply security updates and version changes faster and with less risk. - [Static Analysis: PHPStan and Psalm](https://phpsos.de/en/php/statische-analyse/): PHPStan and Psalm find errors in PHP code without executing it. Psalm additionally traces unsafe data flows. Neither finds vulnerabilities in the PHP interpreter itself. - [Built-in Security Functions of PHP](https://phpsos.de/en/php/eingebaute-sicherheitsfunktionen/): PHP ships with secure building blocks for passwords, random values, escaping, cryptography and sessions. Anyone who uses them consistently avoids the most common application errors. - [Local PHP Development: Docker, DDEV and More](https://phpsos.de/en/php/php-lokal-entwickeln/): For local PHP development there is the built-in web server, official Docker images and tools such as DDEV. What matters is that the same PHP version runs locally as in production. - [PHP Compared with Node.js, Python and Java](https://phpsos.de/en/php/php-im-vergleich/): PHP, Node.js, Python and Java differ mainly in execution model and operation. No language is inherently more secure; what matters is maintenance and the patch process. - [How the PHP Project Handles Security Vulnerabilities](https://phpsos.de/en/php/php-sicherheitsprozess/): Vulnerabilities in PHP are reported confidentially, rated, fixed in a release and published as a GitHub security advisory. PHP2Shell shows the process in an emergency. - [Compiling PHP from Source Code](https://phpsos.de/en/php/php-kompilieren/): PHP can be built yourself with configure and make. This gives control over extensions and options, but also full responsibility for every security update. - [Running PHP in Containers](https://phpsos.de/en/php/php-in-containern/): PHP in a container needs the right image variant, a production configuration, sensible memory limits and a process that rebuilds images with every security release. - [The Future of PHP](https://phpsos.de/en/php/zukunft-von-php/): PHP is developed according to fixed rules: four years of support per version, PHP 8.6 is planned for 19 November 2026, and there are accepted RFCs for PHP 9.0 but no date. - [PHP Basics for Admins](https://phpsos.de/en/php/php-grundwissen-admins/): What admins need to know about PHP: which binaries run, how configuration takes effect, how FPM pools work and which commands help with updates such as the one for PHP2Shell.