What is PHP: Whenever we open a news website on our mobile or computer, do online shopping or fill a form on any government portal, a whole page opens before us in a second. We see only colorful photos, written words and buttons on the screen. But behind this shiny screen there is a technology that works day and night, the name of which the common internet user has hardly heard.

The name of this technology is PHP. Recently, this three-letter name made headlines around the world when several government websites across Europe had to be shut down suddenly due to two major flaws found in it. The American security agency NSA also had to issue an emergency alert. The question is, what is this PHP, on which almost the entire Internet is based, and why do governments around the world break a sweat if there is even the slightest problem with it?

Effective immediately, all organizations using PHP for their systems are advised to be prepared for an update that addresses two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide direct access to the server’s file system or database. If an immediate update is not possible, it is recommended that organizations take the system offline until it can be completely relaxed. The NSA will soon follow with more specific guidance.

— NSA Cyber ​​(@NSACyber) October 21, 2026

What is PHP?

In technical parlance, PHP (what is PHP) is a programming language that runs websites. But to understand in common language, the example of restaurant is most appropriate. When you walk into a restaurant, you see the menu cards, the tables and chairs, and the decorations. In the Internet world, this external form of a website is created with languages ​​such as HTML. But when you order the food of your choice from the waiter, the real work begins inside the restaurant kitchen. The chef present in the kitchen takes out the vegetables, spices and essentials from the store room, cooks them, decorates the prepared plate and sends it to your table by the waiter.

In the world of websites, PHP is just like a cook, working behind the scenes ie on the server. When you click on a website link in your phone’s browser, you are sending an order to the server. That’s where PHP comes into action right away. It collects news, photos, your profile information and important files from the server’s database. After this, it connects them all to form a complete web page and sends it to your mobile or computer screen in the blink of an eye. The user only sees the finished page, while all the heavy lifting is done behind the scenes by PHP.

70 percent of websites worldwide are based on PHP

This language is the foundation of most of the internet we see today. Statistics from W3Techs, a web technology watchdog, show that nearly 70 percent of websites with a recognizable programming language worldwide run on PHP alone. That is, this engine is behind 7 out of every 10 websites on the Internet.

There are two main reasons behind its huge success. The first reason is that PHP is completely free and open source. It is not owned by a single company, instead volunteers from around the world work together to maintain and improve it. The second biggest reason is WordPress. The world’s most popular website building software, WordPress, runs entirely on the PHP engine. Today, nearly 40 percent of the world’s websites are built on WordPress. These include common people’s blogs, small shopper pages, large online shopping sites, news portals and government websites. Interestingly, most website owners never come into direct contact with PHP, as it quietly does its work in the background.

Why one flaw puts millions of websites at risk

While the overuse of any technology offers convenience, it also poses a major risk. Put it this way, if 70 percent of the homes in a city are locked by the same company and a thief figures out how to open those locks without a key, all the homes will become insecure at the same time. This is what happened with PHP recently. The two flaws found in it were given a very dangerous rating of 9.2 out of 10 on the Cyber ​​Security Scale (CVSS v4.0).

According to the European Union’s Cyber ​​Security Team (CERT-EU) and the American agency NSA, this type of flaw allows hackers to directly access the website’s servers and databases without any password or account. In technical parlance this is called ‘unauthenticated remote code execution’. According to web hosting company GoDaddy, this means a hacker can remotely steal website data, deface a web page or take over an entire system.

Small businesses and small websites have been hit the hardest in this situation. Big companies and governments have their own cyber security experts, who immediately take websites offline and update systems. But smaller websites often run on ‘shared hosting’. Think of it as a building where hundreds of small websites are hosted in one big server. The owners of this website neither have security staff nor manage the servers. They also don’t know who will update PHP on their server. WordPress’ security plugin WordFence has also made it clear that normal automatic website updates cannot fix such a fundamental flaw. For this, direct changes have to be made at the server level.

How AI caught a flaw that had been hidden for decades

This recent case involving PHP is also historic because it shows that the world of cybersecurity has changed. According to Google’s parent company Alphabet’s security firm Wiz, the flaws now found in PHP have been present for decades. But these bugs were so complex that finding them and proving that they could lead to hacking was at the very limit of the practical capabilities of human researchers.

This is where artificial intelligence i.e. AI came in. Security firm Calif discovered the first flaw using OpenAI’s ‘GPT-5.6 Sol’ model, while Wiz also discovered the second flaw using an AI model. US President Donald Trump’s administration has hailed it as a ‘super intelligence’ (SI) power as a major achievement for national security.