The PHP behind your company website, and the update it needs now

Your company website may well run on PHP. Many of the online shops you buy from do too. You have never seen it, and that is by design. PHP's own manual says a visitor "would not know what the underlying code was."

On 21 October 2026, the people who make PHP told every user to update it immediately. Which PHP version does it run, and has it been fixed?

Your website is built fresh for each visitor

You may picture a website as finished pages stored on a computer. On a PHP site, each page is built at the moment someone asks for it.

1. A customer's phone asks your web server for a page. The web server is the computer that holds your website.
2. PHP runs on that server. It builds the page, for example with your latest prices from a database.
3. The server sends back only the finished page. In the manual's words, "the code is executed on the server, generating HTML which is then sent to the client."

The manual adds that a server can be set up so that "there's no way that users can tell that PHP is being used."

PHP runs most websites whose language can be seen

W3Techs, a website survey company, reported on 30 October 2026 that PHP runs on 69.2% of websites where W3Techs can identify the server's programming language. W3Techs cannot see inside every site, and, as the manual says, some sites hide PHP completely.

The best-known program built on PHP is WordPress. WordPress.org says it is "built on PHP and MariaDB." W3Techs counts WordPress on 39.5% of all websites. Wikipedia runs on MediaWiki, which "uses PHP to process and display data stored in a database."

PHP itself was created in 1994 by Rasmus Lerdorf, according to php.net. It is free and open source. Today The PHP Foundation, funded by companies and individuals, pays a team of developers to work on its maintenance, security and new features. Its 2025 report says 11 Foundation developers work on PHP, and that they wrote roughly 42% of all changes to PHP's core that year.

On 21 October, PHP's makers said: update now

php.net published a security advisory headed "Critical remote code execution vulnerabilities, update now." It says the new releases "fix two critical vulnerabilities that can allow unauthenticated remote code execution."

In plain words, on a server without the fix, a stranger could run their own commands without a password. php.net says every PHP installation that serves web pages is at risk. The risk is highest on one common set-up, where a demonstrated attack works "before any application code runs", so a well-written website is not protected on its own.

The fixed versions are:

• 8.5.12
• 8.4.27
• 8.3.36
• 8.2.35

Per-release notes on php.net say: "There are no complete mitigations, updating is the only safe choice."

On 22 October, MyCERT, part of CyberSecurity Malaysia, issued advisory MA-1484.102026 on the same flaws. It says "The flaws are in PHP itself, not in application code," and names government portals, e-commerce, hosting providers and critical infrastructure sectors running PHP as high risk. Its advice: "Patching is the only permanent fix."

Every PHP version has an end date

A new PHP version arrives about once a year. The newest, 8.5, came out on 20 November 2025. Each version, such as 8.3 or 8.4, is supported for a fixed time. php.net's policy is two years of full support, then "two additional years for critical security issues only." After those four years the version reaches its "end of life": no more security fixes from the PHP project.

On 30 October 2026, when this story was last checked:

• Supported: 8.2, 8.3, 8.4 and 8.5.
• End of life: 8.1 and everything older, including all of PHP 7 and PHP 5.
• Next to go: 8.2, on 31 December 2026. php.net says it "will receive no further security fixes after that date."

Because the October flaws are so serious, php.net says its security team also made minimal one-off fixes for 7.4, 8.0 and 8.1, as an exception.

A version number alone is not proof

php.net's advisory says "Linux distributions and LTS vendors received the patches in advance, so check your vendor for updated packages." In plain words, the companies that package PHP for servers got the fix early. If your host installs PHP from one of them, a server can show an older number and still carry the fix. A newer number is no guarantee either. Only the person who runs your server can tell you for sure.

One question for your web vendor or host

How to check Ask your web vendor or hosting company, in writing: "Which PHP version does our website run, and is it patched for the October 2026 advisory?" A good answer names 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a newer release in the same series, or says the supplier's patched package for the October advisory is installed. If the answer is 8.2, ask what the plan is before 31 December 2026. If the answer is 8.1 or older, ask when the site moves to a supported version.

You do not need to understand PHP to ask this, only to know who looks after your server.

On Friday: the story of Rasmus Lerdorf, who wrote the first PHP tools to track visits to his online resume.