PHP stands for PHP: Hypertext Preprocessor.
It’s a programming language which runs on a web server, behind the scenes of a website, and effectively lets you see the sites you visit.
When you go to a site, PHP is the code which collects data and effectively turns it into a page you can read.
It was developed in the early 1990s to help serve dynamic web pages and applications, but still powers lots of platforms today.
PHP has been used across a wide range of platforms including Wikipedia, online shops and WordPress – the system behind many websites – as well as to write tools to build web apps, with Laravel, Symfony and Drupal among popular PHP frameworks.
According to cyber-security firm Wiz, external, which helped uncover the critical PHP vulnerabilities surfaced this week, PHP powers 70% of the world’s websites.
And it said the flaws – now coined “php2shell” – were inherent in the language itself, affecting many past versions of it.
The PHP Foundation, the non-profit which maintains the programming language, warned this meant that, under the right conditions, an unauthenticated attacker would be able to remotely execute code on servers running PHP.
Some large organisations said they had seen a high volume of attempts to breach their systems.
Matthew Prince, the boss of internet infrastructure firm Cloudflare, wrote on X, external on Thursday that the company saw “thousands” of attempts to exploit the PHP vulnerabilities across its network in the 10 hours before it was publicly announced.
“That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within two hours, and millions now,” he added.
Amazon also says it saw hackers attempt to exploit the flaws, but its websites were operating as normal.
