Overview
PHP is a widely deployed server-side scripting language powering CMS stacks (WordPress, Drupal), frameworks (Laravel, Symfony), and custom web applications.
Recent Developments
- 2026-10-21: Emergency security release for CVE-2026-109618 (OOM-path RCE) and CVE-2026-109619 (stale global state RCE); CVSS 9.2; affects PHP 5.4–8.5.11 in web-serving configurations. Patched in 8.5.12, 8.4.27, 8.3.36, 8.2.35 (2026-10-21-php-net-security-advisory-oct-2026, 2026-10-21-php-google-cloud-wiz-disclosure)
- Disclosure coordinated with Wiz Research and NSA; Google cites AI-assisted exploit validation
- 2026-10-24: Post-incident synthesis on php2shell maintenance crisis and global patch wave (2026-10-24-php-ocalypse-php2shell-aftermath)
PHP 8.1 and older are EOL upstream; only limited backports for self-builders—production should upgrade supported branches.