PHP
A language and runtime for server-side web code.
Where It Sits
The small stack marks its layer. Beside it, each related technology links to its own page.
- App
- Framework
- Web Server
- RuntimePHP
- Containers
- OS
- Hypervisor
- Firmware
- Hardware
- Data
About
PHP runs the code behind many websites, WordPress included. In production it does not take web requests itself. Apache can run it in its own processes and IIS through FastCGI, while nginx passes requests to PHP-FPM, PHP's own process manager, running as a separate service. PHP is a rival to Node.js and the other runtimes on the same layer.
How to Spot It
These are signs that a system runs PHP, seen from outside without signing in, such as a response header, a cookie, a path or a default port. They help you find where it runs across your own estate. A version shown to the world also tells anyone scanning which flaws might apply, so it is worth hiding.
- Response header
X-Powered-By: PHP/8.2.12- Cookie
PHPSESSID- Path
/index.php
If It Has a Flaw
A flaw in PHP itself reaches every PHP application on the server, however PHP is run, while a flaw in one PHP application reaches only that application. On 23 October 2026 PHP also reported CVE-2026-115560, a flaw that needs an unusual set-up, and suggested turning off session upload progress until its next regular release.
Well-Known Flaws
Each flaw has a CVE id, the unique number a publicly known vulnerability is given so that every advisory names the same flaw. The id links to the advisory, and the card says what the flaw let an attacker do and how far it reached because of where PHP sits.
CVE-2026-109618 (opens in a new tab)and CVE-2026-1096192026
PHP2Shell
Two flaws in how PHP cleans up memory after a request is cut short let an attacker who had not signed in run code. Each scores 9.2 out of 10 on CVSS v4.0, the common scale for how severe a flaw is.
Reach It reached every PHP site on an unpatched server, sites run through mod_php most of all. CISA lists both flaws as exploited.
Fixed on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
CVE-2024-4577 (opens in a new tab)2024
PHP CGI Argument Injection
On Windows, PHP running as CGI could be tricked into running attacker code.
Reach It reached every PHP application the server ran.
Rivals
Rivals do the same job on the same layer, so a system usually runs one of them in any one place. A flaw in a rival does not reach PHP.
Stacks and Code
PHP is part of the common stacks below, and each stack's page shows who runs every layer. Its code arrives from the sources listed, and each source's page says how bad code could get in through it.
- Its Code Comes From
PackagistOS Packages