About our PHP news
Latest news on PHP, providing comprehensive coverage of PHP security, PHP vulnerability alerts, critical flaws, CVEs, zero-day exploits, PHP2Shell, remote code execution (RCE), emergency patches, PHP updates and releases, PHP 8, PHP-FPM and the PHP Foundation, plus Laravel, Symfony, WordPress, Composer and Packagist news for PHP developers and website owners.
PHP is a free, open-source scripting language built for the web, created by Rasmus Lerdorf in 1994 and now developed by a worldwide community. It remains one of the most widely used server-side languages, behind roughly three quarters of the websites whose language is known. That includes WordPress, Drupal, Joomla and Magento, and PHP frameworks such as Laravel, Symfony, CakePHP and CodeIgniter.
Security is the biggest recurring theme. Because PHP runs so much of the internet, one critical PHP vulnerability can put millions of sites at risk, as in October 2026, when two serious flaws nicknamed PHP2Shell triggered emergency patches, rapid exploit attempts and some websites going offline. Remote code execution (RCE), memory-safety bugs, vulnerable plugins and unsupported versions are constant worries, so site owners track every PHP security update and CVE alert. Applying a PHP patch quickly, and moving off end-of-life versions, is the main defence.
PHP follows a regular annual release cycle. Each version gets two years of active support, then two more years of security fixes only, after which it reaches end of life and stops receiving patches. PHP 8 introduced a just-in-time (JIT) compiler and modern syntax, and later releases keep adding features. Developers rely on Composer and Packagist for packages, PHPUnit and PHPStan for testing and analysis, phpMyAdmin for databases and PHP-FPM to serve busy sites.
The language has a passionate community of PHP developers, with conferences, local user groups and open-source volunteers. The PHP Foundation, launched in November 2021 amid concerns over the funding of core development, now pays developers to maintain the language's core. PHP has long drawn criticism for inconsistent design and a reputation for insecure code, yet it keeps evolving and remains a mainstay of web development.
PHP began as a set of small tools for tracking visits to an online résumé and was first called Personal Home Page Tools. It was later renamed PHP: Hypertext Preprocessor, a recursive acronym. Easy deployment and cheap hosting helped it power the early dynamic web, from blogs to online shops and forums, and that legacy still shapes how millions of sites are run today.
Staying informed matters when a single bug can affect so many sites. Our NewsNow PHP news feed brings together the latest headlines on PHP security, vulnerabilities, patches, releases and the wider PHP ecosystem from reliable sources worldwide, giving developers, agencies and website owners a comprehensive, up-to-date view.
