Is PHP Still Relevant After PHP2Shell? What 166 Live Websites Tell Me

Updated October 24, 2026: added what the PHP2Shell shutdowns mean for PHP, and PHP’s October 23 notice about a third flaw.

Is PHP still relevant? Yes, and it isn’t close. PHP still runs most of the web, including WordPress, and it runs nearly every website my team hosts. This week the question got loud again, after the PHP2Shell bugs led governments to pull websites offline. I hear “isn’t PHP dead?” from developers starting out and from business owners who just got told their site needs a rebuild. Both deserve a straight answer, so this one uses real numbers: public usage data, plus the PHP versions on 166 live PHP sites my team manages today.

I have been building websites since 2008 and have shipped more than 282 of them. Nearly all of them run on PHP. So I have a bias, and I’ll state it up front. What I can add is how the language looks on real small-business sites, measured on the servers we run.

Relevance isn’t the same as trendiness. PHP isn’t what most new startups pick for a fresh app, and it hasn’t been for a while. But “relevant” means it matters to the web as it exists, and on that measure nothing else comes close. If you own a business website, there is a very good chance it runs on PHP right now. If you want work building websites for small businesses, PHP is still the language you will touch most.

For most people, the more useful thing to check is whether the PHP version under their site still gets security fixes. That is where I see real problems, and our numbers are below.

On the evening of October 20, 2026, PHP’s security team warned of two critical flaws, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10. Together they let an attacker run code on an unpatched server without logging in. Fixes shipped on October 21 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to the PHP project’s advisory. The Record reported that researchers at the security firm Calif found the bugs about two months earlier with OpenAI’s tools.

The headlines came from what happened next. Governments and companies took websites offline as a precaution while they patched. On October 22, Baroness Lloyd told the House of Lords that 32 UK government services were unavailable and four more were partly down, The Register reported. Sites in Germany, France, Belgium, Finland and the Netherlands went dark too, along with Australia’s cyber security agency. Most of those shutdowns were precautionary, and she said there was no confirmed compromise of central government systems.

I read this as a sign of how much depends on PHP. Nobody shuts down government services over a language that doesn’t matter. And the response was fast: PHP’s maintainers shipped fixes for four supported versions the day after their warning. The sites left exposed were the ones on PHP 8.1 and older. PHP no longer releases updates for those versions, so their owners had to wait on their Linux distribution or a paid support vendor, or upgrade. That is the same third of WordPress sites I cover below.

Every site in my data runs PHP 8.2, 8.3 or 8.4, and all three versions got the fix on day one. None of them needed a rebuild. They needed an update, and their hosts had the patched builds out within days.

One more thing changed on October 23. PHP published a notice about a third flaw, CVE-2026-115560, in its session upload progress feature. It only affects sites set up in an unusual way, so PHP will fix it in its next regular release instead of an emergency one. Until then, PHP’s advice is to switch that feature off, which is a one-line setting your host can change.

Those figures come from W3Techs’ PHP usage report, which on October 23, 2026 put PHP at 69.3% of sites with a known server-side language. Its WordPress report the same day showed WordPress on 39.6% of all websites and 58.3% of sites with a known content management system. WordPress is only one PHP project. Drupal, Joomla, Magento, Craft CMS and the Laravel framework are PHP too.

Developer surveys tell a different story, and that is where the “PHP is dead” idea comes from. In the 2025 Stack Overflow Developer Survey, 18.9% of all respondents said they used PHP, well behind JavaScript and Python. Both numbers are true. A minority of developers keep a majority of websites running, because one developer can build and look after dozens of small sites. The gap between what developers talk about and what the web runs on explains most of PHP’s reputation.

I pulled these numbers on October 23, 2026 from the two places these sites live: our own servers on xCloud (114 PHP sites) and the WP Engine accounts we manage for agency partners (52 installs). 162 of the 166 are WordPress. Three are Laravel apps and one is a custom PHP app.

Support dates are from PHP’s own supported versions page.

Every one of those versions still gets security fixes from PHP. That is not the norm on the wider web, as the next section shows.

WordPress.org publishes the PHP versions reported by every WordPress site that checks in for updates. In its October 2026 stats:

Add the first three rows together and 34.7% of WordPress sites are on a PHP version that PHP itself has stopped patching. PHP 7.4 alone is 15.5% of all WordPress sites, almost four years after its last security release. And because PHP 8.2 drops out of support on December 31, 2026, more than half of WordPress sites (about 58%) will be on unsupported PHP on January 1 unless their owners update.

The wider web looks the same. W3Techs shows roughly 27% of PHP websites still on PHP 7 and nearly 8% on PHP 5, so about a third of all PHP sites run a version with no security support.

None of that is PHP’s fault. Every one of those versions has a free, supported replacement. These are sites that were launched and then left alone, which is the same pattern I found when I studied what happens to small business websites after launch. A site with someone assigned to updates stays current. A site without one drifts until something breaks.

Some of the criticism was fair. Early PHP let beginners mix database queries straight into HTML, function names were inconsistent, and a lot of insecure code got copied around the internet. Many developers formed their opinion of PHP then and never looked again.

The rest is attention. A language that runs millions of business websites in the background doesn’t make news. A new framework does. If you read developer forums, you’d think every site is a JavaScript app. Then you open the hosting panel for an actual dentist, plumber or law firm, and it’s WordPress on PHP almost every time.

There is also a career angle. Developers are paid more to work on new products at funded startups, and those teams mostly choose JavaScript, TypeScript, Python or Go. That is a fair reason to learn those languages. It says nothing about whether the sites the rest of the economy runs on are going away.

The PHP 8.0 release added the JIT compiler, named arguments and union types. PHP 8.1 brought enumerations and readonly properties. PHP 8.4 added property hooks. And a new version ships every November: 8.5 came out on November 20, 2025.

The ecosystem grew up too. Composer handles packages. Laravel and Symfony are serious frameworks used by large companies. Static analysis tools catch bugs before code ships. And the language has dedicated funding now: The PHP Foundation was set up in 2021 to pay core developers, and its founding members include Automattic (the company behind WordPress.com), JetBrains, Laravel, Symfony and Zend.

The funding matters more to me than any single feature. A language with paid maintainers, a yearly release cycle and published support dates is being looked after like infrastructure, which is what it has become.

This month was a good test. On October 21, 2026, PHP shipped fixes for two critical remote code execution flaws (CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell) in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. My team wrote up what PHP2Shell means for WordPress sites the same day. When I checked on October 23, every WP Engine install we manage on 8.2 or 8.4 was on the patched build, and so was every PHP 8.2, 8.3 and 8.4 build on the xCloud servers I checked.

The sites left exposed were the ones on PHP 8.1 and older. Those versions are past end of life, so PHP released no updates for them, only minimal source patches that a Linux distribution or support vendor has to build and ship. Going by the WordPress.org numbers above, that is about a third of all WordPress sites. Old, unpatched versions are what make a PHP site unsafe, and the same is true of any language.

It helps to split the web into two kinds of projects. The first is the content and commerce website: a company’s site, a blog, a store, a booking page. That world still runs on WordPress, WooCommerce, Shopify and site builders, and the open-source part of it is mostly PHP. The second is the custom web application: a SaaS dashboard, a marketplace, an internal tool. That is where JavaScript and Python have taken a big share of new projects.

Even there, PHP holds its own. 8.9% of all respondents in the 2025 Stack Overflow survey said they used Laravel. Two of our own products are Laravel apps: the platform we use to run our clients’ sites and Snazzy Maps.

PHP’s advantage is that it was built for the web and runs almost everywhere. Every shared host, managed WordPress host and VPS panel supports it out of the box. Python’s advantage is everything outside the browser: data analysis, automation and machine learning libraries that PHP can’t match.

If I were picking for a small business website, I’d pick PHP, because the platform they need (usually WordPress) is PHP and the pool of people who can maintain it is huge. If I were building a data-heavy product, I’d start with Python.

If a developer tells you your site needs a full rebuild because its PHP is outdated, ask what else is wrong with it. Sometimes the site really does need a redesign. But often the honest fix is smaller: update PHP, update the theme and plugins, replace the one plugin that is holding everything back, and test. That is a much smaller job than a new website.

Here is what I’d check first:

• Your PHP version. Anything below 8.2 is out of security support. 8.2 joins that list on December 31, 2026. My team has a step-by-step guide on how to check and update PHP in WordPress.
• What “current” means this month. Here’s the latest PHP version and its support dates.
• Who updates it. A site with nobody assigned to updates will fall behind, whatever language it uses. That pattern is a big part of my research on what happens to small business websites after launch.
• Whether a rebuild solves a business problem. If the site isn’t bringing in leads, that is a real reason to redesign. I wrote about why websites stop getting leads and how to redesign without losing your Google rankings. “PHP is old” isn’t a business problem.

Most of the web work small businesses pay for is PHP work: WordPress builds, WooCommerce stores, plugin fixes, speed tuning, updates and migrations. That’s the work behind five agencies that send us their client builds as a white label web design partner. None of it is going to rewrite itself in another language.

If you are aiming for a job at a tech startup, learn JavaScript or TypeScript first and add Python. If you want to freelance, run an agency, or work with local businesses, learn PHP and WordPress well. Learn modern PHP with Composer, types and a framework like Laravel, not the copy-paste PHP of 2008.

If your site is on an old PHP version, or someone has told you it needs a full rebuild and you want a second opinion, book a call with me. I’ll tell you what your site actually needs, and my team at Snazzy Solutions can do the update safely.