PHP was created in 1994, which in internet years makes it a founding civilization. It now powers roughly 24 million websites — about three-quarters of every site whose server-side language can be identified — assembling pages, talking to databases and running the backend logic underneath the content-management and e-commerce systems most organizations rely on.
This week was a bad week to be load-bearing. Researchers disclosed two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 out of 10, each allowing unauthenticated remote code execution, and each present in the code since PHP 5.4 in 2012. The flaws went undetected for more than a decade before being located and verified with artificial intelligence, and emergency patches rushed out on October 21 for PHP 8.2 and newer.
The language predates Google, the euro and most of the people who now maintain the websites running on it. It survived the browser wars, the mobile revolution and several announced deaths.
Like your satire sourced?
Get the Dispatch — the week's sharpest offenses, with receipts attached.
The web's foundation is older than some of its users' parents' marriages. It is having a week. It will, presumably, be patched and carry on — it has seniority.
The underlying reporting is filed in the Evidence Locker: Computer Weekly (Oct. 21, 2026).
