PHP is a programming language that works behind the scenes on many websites, helping them display information, process requests and connect to databases. This week, two critical security flaws in PHP prompted authorities in Finland, Denmark and the Netherlands to temporarily shut down some public websites. To understand why one piece of software can have such wide consequences, it helps to know what PHP does and how it began.
PHP began with a programmer’s online résumé
In 1994, when making a personal website generally meant writing its pages directly in HTML, Rasmus Lerdorf wanted to count visits to his online résumé. The programmer, born in Greenland and raised in Denmark and Canada, wrote a small set of programs in the C language to do the job. He called them Personal Home Page Tools, soon shortened to PHP.
What started as a visitor counter became a way to make websites do more than display static text. Lerdorf expanded the tools to handle forms and work with databases. In June 1995, he released the source code publicly, allowing other programmers to use and improve it.
The project continued to grow. Developers Andi Gutmans and Zeev Suraski helped rebuild the language, leading to the release of PHP 3 in 1998. By then its letters had acquired a new meaning: PHP: Hypertext Preprocessor. The software had moved far beyond the personal homepage for which it was created.
What PHP does when someone visits a website
When someone opens a website, their browser receives a page to display. But much of the work needed to create that page can happen elsewhere, on the computer hosting the website, known as a server.
PHP runs on that server. It can retrieve a news article from a database, check whether someone is logged in or process an online form. The website then sends the result to the visitor’s browser. As the official PHP documentation explains, the visitor sees the resulting page, not the PHP instructions that produced it.
This is useful whenever a website’s content changes or depends on the person using it. PHP is also part of widely used publishing systems such as WordPress, which needs PHP to run. Many people use PHP-powered services without ever knowing the language is there.
Why PHP security flaws can be dangerous
Because PHP runs on the server, a serious flaw in it can endanger more than the appearance of a webpage. If attackers gain the ability to run their own commands on a vulnerable server, they may be able to access information, alter content or disrupt services.
The two vulnerabilities disclosed in October 2026 are especially serious because they can, in affected installations, allow malicious code to run without the attacker needing a password. That does not mean every website using PHP has been hacked. The risk depends on which software is installed and whether security fixes have been applied.
The PHP development team released updates on 21 October. Authorities temporarily took some websites offline to limit the risk while patches were installed and tested. It is an example of how software that began as a small personal experiment can become essential to public services decades later.
