PHP

What PHP is

PHP is a programming language that runs on a web server and builds web pages before they are sent to a visitor. Code that runs this way is called server-side code. The visitor’s browser never sees the PHP itself, only the finished page it produces.

The name is a recursive acronym, which means the first letter stands for the name itself: PHP: Hypertext Preprocessor. It started out meaning something else. The language began in 1995 as Personal Home Page Tools, a small kit written by Rasmus Lerdorf.¹²

PHP is an interpreted language. A program called the interpreter reads the PHP code and carries it out each time a page is requested, rather than the code being turned into a finished program ahead of time. PHP code can sit right inside an HTML file, between the markers <?php and ?>, which made it easy for people who already wrote web pages to add small bits of logic.¹

It is the most common server-side language on the web by a wide margin. As of October 22, 2026, W3Techs counts PHP on 69.3% of websites whose server-side language it can detect.³ The next most common, JavaScript, stood at 8.1% in the same survey as of October 21, 2026. W3Techs notes that one site can use more than one language, so the shares do not add up to 100%.⁴

Origins: from Personal Home Page Tools to PHP 3

Rasmus Lerdorf created the first version in 1994. According to the PHP project’s own history, it was a set of Common Gateway Interface (CGI) programs written in the C language. CGI is a standard way for a web server to run an outside program and send that program’s output back as a web page. Lerdorf first used the tools to track visits to his online resume.¹

On June 8, 1995, Lerdorf announced the kit to the world on Usenet, a worldwide discussion network older than the web, in the group comp.infosystems.www.authoring.cgi. His post opened: “Announcing the Personal Home Page Tools (PHP Tools) version 1.0.”² The tools logged page visits, showed access counters, password-protected pages, handled forms and offered server-side includes on servers that did not support them.²

Later in 1995 Lerdorf rewrote the code and called it FI, short for Forms Interpreter. It had variables that worked like those in Perl, turned form fields into variables automatically and let authors embed code in HTML. The project’s history describes the syntax as similar to Perl but more limited and somewhat inconsistent.¹

The next version, PHP/FI, combined the two names. In 1996 it added built-in support for the DBM, mSQL and Postgres95 databases, cookies and user-defined functions. PHP/FI 2.0 left beta in November 1997, and it was the only full release of PHP 2.0.¹

Use grew quickly. The PHP history page cites a Netcraft survey from May 1998 in which nearly 60,000 domains sent web headers containing “PHP”, about 1% of all domains at the time.¹

In 1997 two developers from Tel Aviv, Israel, Andi Gutmans and Zeev Suraski, began a complete rewrite of the part of PHP that reads and understands code (the parser). In June 1998 the new PHP Development Team announced PHP 3.0 as the official successor to PHP/FI 2.0. This release gave the language its recursive name.¹

PHP 3.0’s main strength, the history page says, was that it was easy to extend. Dozens of developers submitted modules that added new abilities. PHP 3.0 was on more than 70,000 domains when it was announced and, at its peak, on about 10% of web servers.¹

Major versions

PHP 4 and the Zend Engine (2000)

Gutmans and Suraski next rewrote PHP’s core. They called the new core the Zend Engine, a blend of their first names, Zeev and Andi. An engine, in this sense, is the part of the interpreter that compiles and runs code. It was first introduced in mid-1999.¹ The same year the two founded a company, Zend Technologies.⁵

PHP 4.0.0, built on the Zend Engine, was released on May 22, 2000.⁶ A later 4.x release, PHP 4.2.0 on April 22, 2002, changed an important security default that is covered in the security section below.⁷

PHP 5 (2004)

PHP 5.0.0 arrived on July 13, 2004.⁸ Its core was Zend Engine II, with a new object model.⁸ An object model is the set of rules for objects, the bundles of data and functions used in object-oriented programming.

The 5.x series ran for a decade. PHP 5.3 added namespaces (a way to keep names in one library from clashing with names in another), and PHP 5.4 added traits and a short syntax for arrays.¹ PHP 5.4.0 shipped on March 1, 2012, and PHP 5.6.0 on August 28, 2014.⁹¹⁰

The abandoned PHP 6

The plan for PHP 6 was deep support for Unicode, the standard that lets computers store text in every writing system. The work was later abandoned, and some of its other planned features moved into PHP 5.3 and 5.4.¹

A 2014 proposal by Andrea Faulds and Zeev Suraski set out the timeline: the PHP 6 effort began in 2005 and was abandoned in 2010, mainly because of difficulties with the Unicode implementation. Books and articles about the unreleased PHP 6 already existed, so the authors argued that reusing the number would confuse people. Developers voted 58 to 24 in July 2014 to name the next major version PHP 7.¹¹

PHP 7 and the speed jump (2015)

The speed work behind PHP 7 first appeared in May 2014 as an experimental branch called phpng (PHP next generation), which the project said was not ready for production.¹⁰ PHP 7.0.0 was released on December 3, 2015.¹²

The release announcement said PHP 7 was up to twice as fast as PHP 5.6 and used significantly less memory. It came with a new version of the Zend Engine, which the history page calls Zend Engine 3.0.¹³¹ Version 7.0 also added return type declarations, scalar type declarations and the null coalescing operator (??), a short way to supply a default value.¹³

Scalar type declarations let a programmer state that a function expects, for example, an integer or a string. The proposal passed 108 to 48 in March 2015. It included an optional strict mode, switched on per file with declare(strict_types=1), that rejects values of the wrong type instead of silently converting them.¹⁴

Later 7.x releases added typed properties and a foreign function interface (a way to call code written in C) in PHP 7.4.¹ PHP 7.4.0 was released on November 28, 2019.¹⁵

PHP 8 and the JIT (2020)

PHP 8.0.0 was released on November 26, 2020.¹⁶ Its headline features were named arguments, union types, attributes (structured notes attached to code), the match expression, the nullsafe operator and a just-in-time compiler, or JIT.¹⁷

A JIT turns the most frequently run parts of a program into machine code while the program is running. PHP’s release page reported that the tracing JIT ran about three times faster on synthetic benchmarks and 1.5 to 2 times faster on some long-running applications, while typical web application performance was on par with PHP 7.4.¹⁷

The JIT proposal, by Dmitry Stogov and Zeev Suraski, passed 50 to 2 in March 2019. Its own benchmarks showed why ordinary websites saw little change: WordPress served about 326 requests per second with the JIT and 315 without it, while a CPU-heavy fractal benchmark ran more than four times faster.¹⁸

PHP 8.1 to 8.5

Since 8.0, PHP has shipped one feature release a year, in late November or early December.¹⁹

• PHP 8.1 (November 25, 2021) added enumerations, readonly properties, fibers (a building block for running tasks concurrently) and first-class callable syntax. Its release page reported a 23.0% speedup on the Symfony demo application and 3.5% on WordPress compared with PHP 8.0.²⁰²¹
• PHP 8.2 (December 8, 2022) added readonly classes and disjunctive normal form (DNF) types, a way to combine type rules.¹⁹¹
• PHP 8.3 (November 23, 2023) added typed class constants.¹⁹¹
• PHP 8.4 (November 21, 2024) added property hooks, asymmetric visibility, a new HTML5-compliant DOM parser and a new JIT implementation.¹⁹²²
• PHP 8.5 (November 20, 2025) added the pipe operator (|>), a built-in extension for parsing web addresses, “clone with” and the #[\NoDiscard] attribute.¹⁹²³

PHP 8.6 was in release-candidate testing in October 2026.²⁴

Who makes PHP

PHP is open-source software: its source code is public, and anyone may propose changes. The PHP Group and the project’s contributors hold the copyright in PHP’s code. Zend Technologies, now a subsidiary of Perforce Software, holds copyright in parts of the Zend Engine.²⁵

How changes are decided

Changes to the language go through a public process. Anyone with a proposal writes a Request for Comments (RFC) on the PHP wiki, it is discussed on the developers’ mailing list, and then it is put to a vote.²⁶

The voting rules were adopted in 2011, in a proposal by Zeev Suraski, Pierre Joye and David Soria Parra. Accepting a proposal needs a two-thirds majority. Voters are people with php.net accounts who have contributed code, plus community representatives such as lead developers of major PHP projects.²⁶

Zend

Zend Technologies, founded by Gutmans and Suraski in 1999, sold commercial PHP products and released Zend Framework in 2006. Rogue Wave Software bought Zend in 2015, and Perforce Software bought Rogue Wave in 2019. Zend now sells PHP builds with support that runs past the community’s end-of-life dates.⁵

The PHP Foundation

The PHP Foundation was announced on November 22, 2021, as a body to fund work on the PHP language.²⁰ According to JetBrains, which helped set it up, the trigger was that Nikita Popov, one of PHP’s most active core developers, was leaving JetBrains on December 1, 2021 and would spend much less time on PHP. Too much knowledge sat with too few people.²⁷

The foundation was organized as a nonprofit through Open Collective, a platform that handles money and paperwork for open-source groups. JetBrains planned to give $100,000 a year, and the initial target was about $300,000 a year from all sponsors, mainly to pay core developers.²⁷

In February 2026 the foundation named Elizabeth Barron as executive director. She succeeded founding executive director Roman Pronskiy.²⁸ In May 2026 it created an Ecosystem Security Team, funded by a grant from Alpha-Omega, a security program tied to the Linux Foundation and the Open Source Security Foundation.²⁹

License

An open-source license is the legal permission that lets anyone use, change and share software. For most of its history PHP used its own PHP License 3.01, with a separate Zend Engine License. A 2025 proposal by Ben Ramsey to switch both to the Modified BSD License (known as BSD-3-Clause) passed 51 to 0, with 2 abstentions.³⁰ As of October 2026, php.net says PHP is available under the Modified BSD License, also called the PHP License, version 4, starting with PHP 8.6. Users of earlier versions may also choose it.²⁵

The LAMP stack and software built on PHP

A software stack is a set of programs that work together to run a website. The best-known stack of the early web was LAMP: Linux (the operating system), Apache (the web server), MySQL (the database) and a scripting language starting with P, usually PHP, Perl or Python.³¹

According to Computerworld, the writer Michael Kunze coined the acronym in December 1998 in the German computing magazine Computertechnik, to show that free software could replace expensive commercial packages. The publisher O’Reilly and the company behind MySQL later helped spread the term.³¹

The same basic recipe still runs much of the web. WordPress.org recommends hosting with PHP 8.3 or newer, MySQL 8.0 or MariaDB 10.11 or newer, HTTPS support, and either Apache or Nginx as the web server.³²

Applications written in PHP

A content management system (CMS) is software for publishing and editing a website without writing code for each page. The most widely used ones are written in PHP.

• WordPress is used by 39.6% of all websites and holds 58.3% of the market among sites whose CMS W3Techs can identify, as of October 22, 2026.³³
• Drupal 11 supports PHP 8.3 and 8.4, and PHP 8.5 from version 11.3, and Drupal 10 requires at least PHP 8.1.³⁴
• Joomla describes itself as a free, open-source CMS based on PHP and MySQL.³⁵
• MediaWiki, the wiki software, states that PHP is the language it is written in and that PHP is required to run it.³⁶

A framework is a ready-made foundation of code that developers build custom applications on. Laravel is a PHP framework whose version 12 supports PHP 8.2 to 8.5 and whose version 13 supports PHP 8.3 to 8.5.³⁷ Symfony is both a PHP framework and a set of reusable PHP packages, which, according to Symfony, are used by Drupal, PrestaShop and Laravel.³⁸

Facebook, HipHop and HHVM

Facebook’s website was written in PHP. In February 2010 its engineers released HipHop for PHP, a tool that converted PHP code into C++ so it would run faster. Facebook said the site served more than 400 billion PHP-based page views a month and that HipHop cut CPU use on its web servers by about 50% on average.³⁹

HipHop was followed by HHVM, a virtual machine that ran both PHP and Facebook’s own PHP-derived language, Hack. In September 2018 the HHVM team announced that version 3.30 would be the last to aim for PHP support, and that later versions would focus on Hack.⁴⁰

Security record

Because so many sites run PHP, flaws in PHP itself matter widely. This section covers flaws in PHP itself and in its default settings, not flaws in the applications built with it.

register_globals

In early PHP, values from outside a script, such as fields in a web address, form data, cookies and server settings, were turned into ordinary global variables by default. This setting was known as register_globals. So a value sent with a request could turn up as a variable inside the script.

PHP 4.2.0, released in April 2002, changed the default so that outside values were no longer registered as global variables. The project recommended that code read them from special arrays called superglobals, introduced in PHP 4.1.0.⁴¹⁷ PHP 5.4.0 removed register_globals completely, along with two other old features, magic quotes and safe mode.⁴²

Notable vulnerabilities

A vulnerability is a flaw that an attacker can use to make software do something it should not. Each publicly known one gets an ID from the CVE (Common Vulnerabilities and Exposures) program.

• CVE-2012-1823. In May 2012, PHP fixed a flaw in setups that run PHP as a CGI program, which it said had gone unnoticed for at least eight years. Apache with mod_php and Nginx with PHP-FPM were not affected.⁹ The U.S. National Vulnerability Database shows a CVSS 3.1 severity score of 9.8 out of 10 for it, supplied by CISA, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its catalog of exploited vulnerabilities in March 2022.⁴³
• CVE-2024-4577. The security firm DEVCORE found that a Windows character-conversion feature could bypass the 2012 fix. DEVCORE reported it on May 7, 2024, and PHP fixed it on June 6, 2024, in versions 8.3.8, 8.2.20 and 8.1.29.⁴⁴⁴⁵ PHP’s advisory, which credits DEVCORE researcher Orange Tsai, says an attacker could run any PHP code on an affected Windows server.⁴⁶
• PHP2Shell (2026). On October 21, 2026, PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical flaws, CVE-2026-109618 and CVE-2026-109619, that could let an attacker run code on a web server without logging in.⁴⁷ Researchers at Wiz, who published the flaws under the name PHP2Shell, said every PHP version released in the previous decade, back to PHP 5.4, had at least one of them.⁴⁸

Attacks on the project itself

In March 2021, two malicious changes were pushed into PHP’s source code under the names of Rasmus Lerdorf and Nikita Popov. Popov wrote that everything pointed to a break-in at the project’s own git.php.net server. The project shut that server down and made its copies on GitHub the official ones, with two-factor authentication required for anyone who can make changes.⁴⁹

Audits and the security team

In 2024 the security firm Quarkslab audited the most critical parts of PHP’s source code. The audit was organized by the Open Source Technology Improvement Fund and paid for by Germany’s Sovereign Tech Agency. It found 27 issues, 17 with security implications, 3 of them rated high.⁵⁰⁵¹

The PHP Foundation later said that, while fixing an issue from that audit, a core developer found the first signs of the memory problem behind PHP2Shell, and that the fix then stalled for months because the security team worked by consensus and could not agree on an approach. It called the delay “a structural failure” and said it had begun changing its processes so decisions can be made by majority.⁵¹

Version support

Each PHP branch (for example 8.4) gets two years of active support, with regular bug and security fixes, and then two more years of fixes for critical security issues only. After four years the branch reaches end of life and gets no more updates from the PHP project.¹⁹ The dates below come from php.net’s supported-versions and end-of-life pages and the release announcements cited above.¹⁹⁵²

Many sites run older branches. Among websites that use PHP, W3Techs counts 65.3% on PHP 8, 26.9% on PHP 7, 7.7% on PHP 5 and 0.1% on PHP 4, as of October 22, 2026.³ None of the PHP 7, 5 or 4 branches get fixes from the PHP project, and neither do PHP 8.0 and 8.1.⁵²

An end-of-life branch is not always unpatched. Linux distributions and long-term support (LTS) vendors often copy fixes back into older versions they still ship, a practice called backporting.⁴⁷ Zend also sells PHP builds with support beyond the community schedule.⁵ For PHP2Shell, the PHP security team itself published minimal fixes for PHP 7.4, 8.0 and 8.1 because the flaws were so severe.⁴⁷

Criticism and defenses

PHP has been criticized for as long as it has been popular. The arguments are worth knowing because they shaped how the language changed.

Design

The best-known critique is a 2012 essay by the programmer Eevee titled “PHP: a fractal of bad design.” It argued that PHP’s built-in functions are named and ordered inconsistently, that its loose comparison operator (==) converts types in surprising ways, and that errors are too easy to miss.⁵³ PHP’s own history page describes the syntax of the 1995 version as “somewhat inconsistent.”¹

Defenders point to how much the language has changed since then: optional strict typing in 2015, typed properties in 7.4, and union types, enumerations and readonly classes in the 8.x series.¹⁴¹

Results versus elegance

In 2008, the programmer Jeff Atwood, who called PHP badly designed, argued that it mattered less than people thought, because many large and successful sites had been built with it.⁵⁴ Facebook’s engineers, for example, said they valued PHP because it let them move fast, even as they built tools to work around its speed limits.³⁹

Speed

Speed was a known weakness: Facebook built HipHop because, its engineers wrote, C++ far outperforms PHP in processor and memory use.³⁹ PHP 7 was then announced as up to twice as fast as PHP 5.6.¹³ The JIT added in PHP 8.0 helps CPU-heavy code far more than typical websites.¹⁸

Security and process

Critics have pointed to unsafe defaults such as register_globals, which PHP turned off by default in 2002 and removed in 2012.⁴¹⁴² The handling of PHP2Shell drew criticism from inside the project itself: the PHP Foundation said the fix for the underlying bug had stalled for months.⁵¹ Supporters note that the project now pays for outside audits and full-time security engineers through the foundation.⁵⁰²⁹

PHP today

As of October 22, 2026, four PHP branches get updates from the PHP project: 8.2, 8.3, 8.4 and 8.5. PHP 8.2’s security support ends on December 31, 2026, and PHP 8.4’s active support ends the same day.¹⁹ The newest release in each branch is 8.5.12, 8.4.27, 8.3.36 and 8.2.35, all published on October 21, 2026 to fix PHP2Shell.⁴⁷

WordPress, the most used CMS, requires PHP, and the language’s share of the web, 69.3% of sites with a known server-side language, is far ahead of any other language W3Techs tracks.³³³⁴

The number of security reports has grown. The PHP Foundation said in October 2026 that the PHP security team had published 15 CVEs since July 1 and had handled more than 100 reports that turned out to be invalid, duplicates or impossible to reproduce. The foundation linked the higher volume to AI-assisted research. The foundation said AI helps sort reports, but a person makes every decision and works on every fix.⁵¹

Timeline

1. October 21, 2026PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix the PHP2Shell flaws⁴⁷
2. May 18, 2026The PHP Foundation creates an Ecosystem Security Team²⁹
3. November 20, 2025PHP 8.5 is released, with the pipe operator¹⁹
4. November 21, 2024PHP 8.4 is released, with property hooks¹⁹
5. November 25, 2021PHP 8.1 is released, with enumerations and fibers²⁰
6. November 22, 2021The PHP Foundation is announced to fund PHP development²⁰
7. March 28, 2021After malicious commits, PHP moves its official code to GitHub⁴⁹
8. November 26, 2020PHP 8.0 is released, with a JIT compiler¹⁶
9. December 3, 2015PHP 7.0 is released, up to twice as fast as PHP 5.6¹²
10. July 2014Developers vote 58 to 24 to skip PHP 6 and name the next version PHP 7¹¹
11. March 1, 2012PHP 5.4.0 removes register_globals, magic quotes and safe mode⁴²
12. July 13, 2004PHP 5.0.0 is released with Zend Engine II⁸
13. April 22, 2002PHP 4.2.0 stops registering request values as global variables by default⁴¹
14. May 22, 2000PHP 4.0.0 is released on the new Zend Engine⁶
15. June 1998PHP 3.0, rewritten by Andi Gutmans and Zeev Suraski, is announced¹
16. November 1997PHP/FI 2.0 leaves beta¹
17. June 8, 1995Rasmus Lerdorf announces Personal Home Page Tools on Usenet²

What it means for your website

See also

• Rasmus Lerdorf (coming soon)
• PHP2Shell (2026)
• WordPress
• MySQL (coming soon)
• Apache HTTP Server (coming soon)
• WordPress review
• Web hosting
• Cms

References

1. History of PHP. The PHP Documentation Group, php.net. accessed October 22, 2026.
2. Announce: Personal Home Page Tools (PHP Tools). Rasmus Lerdorf, Usenet group comp.infosystems.www.authoring.cgi, via Google Groups. 1995-06-08. accessed October 22, 2026.
3. Usage statistics and market share of PHP for websites. W3Techs. 2026-10-22. accessed October 22, 2026.
4. Usage statistics of server-side programming languages for websites. W3Techs. 2026-10-21. accessed October 22, 2026.
5. About Zend. Zend by Perforce. accessed October 22, 2026.
6. PHP news archive, 2000 (PHP 4.0.0 Released). The PHP Group. 2000-05-22. accessed October 22, 2026.
7. PHP news archive, 2002 (PHP 4.2.0 released). The PHP Group. 2002-04-22. accessed October 22, 2026.
8. PHP news archive, 2004 (PHP 5.0.0 Released). The PHP Group. 2004-07-13. accessed October 22, 2026.
9. PHP news archive, 2012. The PHP Group. 2012. accessed October 22, 2026.
10. PHP news archive, 2014. The PHP Group. 2014. accessed October 22, 2026.
11. PHP RFC: Name of Next Release of PHP. Andrea Faulds and Zeev Suraski, PHP wiki. 2014-07-05. accessed October 22, 2026.
12. PHP news archive, 2015 (PHP 7.0.0 Released). The PHP Group. 2015-12-03. accessed October 22, 2026.
13. PHP 7.0.0 Release Announcement. The PHP Group. 2015-12-03. accessed October 22, 2026.
14. PHP RFC: Scalar Type Declarations (version 0.5). Anthony Ferrara and Andrea Faulds, PHP wiki. 2015-02-18. accessed October 22, 2026.
15. PHP 7 ChangeLog. The PHP Group. accessed October 22, 2026.
16. PHP news archive, 2020 (PHP 8.0.0 Released). The PHP Group. 2020-11-26. accessed October 22, 2026.
17. PHP 8.0 release page. The PHP Group. 2020-11-26. accessed October 22, 2026.
18. PHP RFC: JIT. Dmitry Stogov and Zeev Suraski, PHP wiki. 2019-01-28. accessed October 22, 2026.
19. Supported Versions. The PHP Group. accessed October 22, 2026.
20. PHP news archive, 2021. The PHP Group. 2021. accessed October 22, 2026.
21. PHP 8.1 release page. The PHP Group. 2021-11-25. accessed October 22, 2026.
22. PHP 8.4 release page. The PHP Group. 2024-11-21. accessed October 22, 2026.
23. PHP 8.5 release page. The PHP Group. 2025-11-20. accessed October 22, 2026.
24. PHP news archive, 2026. The PHP Group. 2026. accessed October 22, 2026.
25. PHP Licensing. The PHP Group. accessed October 22, 2026.
26. Request for Comments: Voting on PHP features. Zeev Suraski, Pierre Joye and David Soria Parra, PHP wiki. 2011-06-05. accessed October 22, 2026.
27. The PHP Foundation. JetBrains PhpStorm blog. 2021-11-22. accessed October 22, 2026.
28. Welcoming Elizabeth Barron as the New Executive Director of The PHP Foundation. The PHP Foundation. 2026-02-27. accessed October 22, 2026.
29. Announcing the Ecosystem Security Team at The PHP Foundation. The PHP Foundation. 2026-05-18. accessed October 22, 2026.
30. PHP RFC: PHP License Update. Ben Ramsey, PHP wiki. 2025-07-10. accessed October 22, 2026.
31. LAMP. Russell Kay, Computerworld. 2006-09-25. accessed October 22, 2026.
32. Requirements. WordPress.org. accessed October 22, 2026.
33. Usage statistics and market share of WordPress. W3Techs. 2026-10-22. accessed October 22, 2026.
34. PHP requirements. Drupal.org. accessed October 22, 2026.
35. What is Joomla. Joomla project. accessed October 22, 2026.
36. Manual:Installation requirements. MediaWiki.org. accessed October 22, 2026.
37. Release Notes, Laravel 12.x. Laravel. accessed October 22, 2026.
38. What is Symfony. Symfony. accessed October 22, 2026.
39. HipHop for PHP: Move Fast. Haiping Zhao, Facebook Engineering. 2010-02-02. accessed October 22, 2026.
40. Ending PHP Support, and The Future Of Hack. Fred Emmott, HHVM blog. 2018-09-12. accessed October 22, 2026.
41. PHP 4.2.0 Release Announcement. The PHP Group. 2002. accessed October 22, 2026.
42. PHP 5.4.0 Release Announcement. The PHP Group. 2012-03-01. accessed October 22, 2026.
43. CVE-2012-1823 Detail. National Vulnerability Database, NIST. accessed October 22, 2026.
44. Security Alert: CVE-2024-4577, PHP CGI Argument Injection Vulnerability. DEVCORE. 2024-06-06. accessed October 22, 2026.
45. PHP news archive, 2024. The PHP Group. 2024. accessed October 22, 2026.
46. PHP RCE: A Bypass of CVE-2012-1823, Argument Injection in PHP-CGI (GHSA-3qgc-jrrr-25jv). PHP project on GitHub. accessed October 22, 2026.
47. Security advisory: Critical remote code execution vulnerabilities, update now. The PHP Group. 2026-10-21. accessed October 22, 2026.
48. PHP2Shell. Wiz Research (Sagi Tzadik, Shir Tamari, Nir Ohfeld and Tomer Schwartz). 2026-10-21. accessed October 22, 2026.
49. Changes to Git commit workflow. Nikita Popov, php.internals mailing list. 2021-03-28. accessed October 22, 2026.
50. PHP Core Security Audit Results. The PHP Foundation. 2025-04-10. accessed October 22, 2026.
51. Today's PHP Security Release, and How We're Strengthening PHP Security. The PHP Foundation. 2026-10-21. accessed October 22, 2026.
52. Unsupported Branches. The PHP Group. accessed October 22, 2026.
53. PHP: a fractal of bad design. Eevee, fuzzy notepad. 2012-04-09. accessed October 22, 2026.
54. PHP Sucks, But It Doesn't Matter. Jeff Atwood, Coding Horror. 2008-05-20. accessed October 22, 2026.
55. Site Health Screen. WordPress.org Documentation. accessed October 22, 2026.

Web Building Encyclopedia. First published October 22, 2026. Last reviewed October 22, 2026. Every fact on this page is linked to a source we opened. Spotted an error? Write to [email protected].