In short: PHP is an open-source scripting language used mainly for web applications. The code runs on the server, generates HTML there and sends only the result to the browser. Because many CMS, shop systems and internal tools are built on PHP, the PHP version on the server is a security factor in its own right, independent of the CMS update.
What is PHP? A definition in plain words
The PHP manual describes PHP as a widely used, open-source, general-purpose scripting language that is especially suited to web development and can be embedded in HTML. The name is a recursive acronym, that is, an abbreviation that contains itself: "PHP: Hypertext Preprocessor".
The key difference from JavaScript in the browser: PHP code is executed on the server. The visitor receives only the finished result and does not see the source code. This makes PHP suitable for anything that must stay confidential, such as database access, logins or price calculations.
According to the manual, PHP has two main areas of use: server-side scripts for websites and scripts on the command line, for example recurring tasks run via cron. You will find both in almost every company that operates its own website, a shop or a customer portal.
Where does PHP sit in your company?
PHP is rarely visible directly. It sits inside software that you know under other names. Typical examples:
- Content management systems such as WordPress, TYPO3, Joomla, Drupal or Contao
- Shop systems such as Shopware, WooCommerce, Magento or PrestaShop
- Internal services such as Nextcloud, Moodle, MediaWiki or Matomo
- Custom developments based on frameworks such as Laravel or Symfony
- Web interfaces of devices and hosting panels
Each of these applications needs an installed PHP runtime, that is, the program that executes the PHP code. This runtime is a separate piece of software with its own updates. Updating WordPress or Shopware does not update PHP. Which systems you operate therefore belongs in an inventory, as described in the article Inventory of all websites and servers.
What does PHP code look like?
PHP code sits between the markers <?php and ?>. Everything outside is output unchanged as HTML. A small, harmless example:
<?php
$stunde = (int) date('G');
$gruss = $stunde < 12 ? 'Guten Morgen' : 'Guten Tag';
?>
<!DOCTYPE html>
<html lang="de">
<body>
<p><?= htmlspecialchars($gruss) ?>, heute ist der <?= date('d.m.Y') ?>.</p>
</body>
</html>
The server executes the PHP part and sends the browser only finished HTML, such as "Guten Tag, heute ist der 25.10.2026" (German for "Good day, today is 25 October 2026"). The htmlspecialchars() function converts special characters and thus protects against injected HTML. Built-in protective functions like this are one reason why cleanly written PHP code can be secure.
What components make up a PHP environment?
A PHP website consists of more than the application code. Several layers work together, and each needs its own maintenance:
| Component | Task | Who typically updates it? |
|---|---|---|
| Web server (Apache, Nginx, LiteSpeed) | accepts requests from the network | hosting provider or server admin |
| PHP runtime (interpreter) | executes the PHP code | hosting provider, server admin, package source |
| Extensions | database drivers, image processing, encryption | together with the PHP runtime |
Configuration (php.ini) |
limits, error output, sessions | server admin |
| Application (CMS, shop) | content and business logic | agency or in-house team |
| Plugins and libraries | additional functions | agency or in-house team |
The link between the web server and PHP is called SAPI (Server Application Programming Interface). Whether PHP runs as an Apache module, via PHP-FPM or as CGI has consequences for operation and security. More on this under SAPI explained and in the article How PHP generates a web page.
Why the PHP version matters for security
Each PHP version is maintained only for a limited time. According to php.net, every version branch gets two years of active support and then two more years of security fixes only. After that the branch has reached end of life and receives no more official updates. The details are on PHP versions and release cycle.
PHP2Shell shows how important this is. In October 2026, two critical flaws in PHP itself became known, CVE-2026-109618 and CVE-2026-109619, both with CVSS v4.0 9.2. They allow remote code execution without authentication. They are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For PHP 8.1 and older there are no official updates any more.
Three points follow for decision-makers:
- A CMS update does not close a flaw in PHP. Both must be updated separately.
- After a PHP update, all PHP processes must be restarted, otherwise the old code keeps running in memory.
- A patch does not prove that nothing happened beforehand. For unprotected servers, a check for traces belongs to the process.
Settle in writing who is responsible for the PHP runtime in your organisation: the hosting provider, an agency or your own IT. With PHP2Shell it became clear that this question was open in many companies.
What the flaw is exactly and who it affects is explained on the page What is PHP2Shell?.
How does PHP SOS help?
- Take stock: We determine which of your systems use PHP, in which version and operating mode.
- Clarify responsibility: We show which parts your hosting provider maintains and which lie with you or your agency.
- Update: Through the PHP patch service we install updates, restart all processes and document the state.
- Check afterwards: Where a server was reachable without protection, we check for traces of an intrusion.
Frequently asked questions
Is PHP a programming language or just a scripting language?
Both are true. PHP is a full, general-purpose programming language with functions, classes and types. It is called a scripting language because the source code is not compiled into an executable file in advance but is processed by the PHP interpreter at runtime.
Can visitors to my website see the PHP code?
No. PHP runs on the server, and the browser only receives the result, usually HTML. Exceptions arise from misconfiguration, for example when the web server delivers PHP files as plain text or when backup copies such as index.php.bak are publicly accessible.
How can I tell whether my website runs on PHP?
Most widely used CMS and shop systems such as WordPress, TYPO3, Shopware, Joomla or Nextcloud are written in PHP. You can find out for certain from your hosting provider, your agency or by looking at the server configuration.
As a managing director, do I need to understand PHP?
Not in detail. What matters is knowing that PHP is a separate piece of software with its own updates, independent of the CMS. It should be settled in writing who is responsible for the PHP version on your servers.