What is PHP and why a bug can affect so many web pages

The PHP ecosystem security team alerted this Wednesday, October 21, of two critical vulnerabilities that could allow attackers to execute code remotely on servers.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, obtained a severity score of 9.2 out of 10 on the CVSS 4.0 scale. Additionally, cybersecurity company watchTowr referred to these flaws as 'PHP2shell' and warned that they could allow malicious code to be executed on vulnerable servers, opening the door to altering web pages or stealing information.

According to INCIBE, the bugs have affected PHP versions from branch 5 onwards and, although their potential scope is broad, at the moment no cases of exploitation of these vulnerabilities have been reported. However, to fix the flaws, the PHP team announced a security update and urged administrators to install it as soon as possible, taking into account the vulnerabilities led to preparing an urgent security update while some administrators preemptively isolated websites and applications to reduce risks.

What is PHP?

PHP is an open source, general-purpose programming language for developing web pages and applications, processing forms, managing sessions, and querying databases. Unlike JavaScript, PHP code is processed on the server before sending the final result in HTML format to the browser and allows you to generate personalized content based on the user's actions or data.

Also, this programming language operates in the background, is free, has native integration with database management systems such as MySQL or PostgreSQL, works on various operating systems and web servers, allows mobile applications to communicate with web servers, handles forms and sessions, and is even the basis of popular platforms such as WordPress.

It is worth mentioning that its wide presence on the Internet made the vulnerability alert acquire special relevance due to the number of services that could be affected, because PHP supports nearly 70% of all websites whose programming language can be identified.

Why a PHP bug could affect a large part of the internet?

PHP is one of the most popular programming languages ​​for creating websites, so a vulnerability in its code can put numerous online services at risk. Platforms such as WordPress, MediaWiki and Symfony use this technology to perform different functions, although the exposure depends on how their systems are configured and the versions they use.