PHP

What is PHP?

PHP (PHP: Hypertext Preprocessor) is an open-source, server-side scripting language built for the web. The web server runs PHP code to generate each page, then sends the finished HTML to the visitor's browser. PHP was first released in 1995 and is maintained by the PHP project with support from the PHP Foundation.

What is PHP used for?

PHP powers dynamic websites, content management systems and online stores. Popular PHP-based platforms include WordPress, Drupal, Joomla, Magento (Adobe Commerce), TYPO3 and Craft CMS, along with frameworks such as Laravel and Symfony.

What was the October 2026 PHP vulnerability?

In October 2026, the PHP project fixed two critical flaws in the PHP interpreter, CVE-2026-109618 and CVE-2026-109619, often called PHP2Shell. Both can let an attacker run their own code on a web server without logging in. Because they sit in PHP itself, they affect every CMS and application running on a vulnerable PHP version.

The PHP security team rated both flaws 9.2 out of 10 under CVSS v4.0; security firm watchTowr rated them 10.0. Researchers at Calif and Wiz reported the issues in August 2026. Details leaked on 20 October, and fixes were released on 21 October 2026.

What are the current PHP versions?

PHP ships a new minor version every year, and each one gets a fixed support window: active support first, then security fixes only, then end of life. As of October 2026, PHP 8.5 is the latest release.

Version	Released	Support status (Oct 2026)
PHP 8.5	Nov 2025	Active support (latest)
PHP 8.4	Nov 2024	Active support until 31 Dec 2026, then security fixes only
PHP 8.3	Nov 2023	Security fixes only, until 31 Dec 2027
PHP 8.2	Dec 2022	Security fixes only, until 31 Dec 2026
PHP 8.1	Nov 2021	End of life (31 Dec 2025)
PHP 8.0	Nov 2020	End of life (26 Nov 2023)
PHP 7.4	Nov 2019	End of life (28 Nov 2022)

PHP 8.6 is expected on 19 November 2026. Running a supported version matters: when the October 2026 flaws were fixed, only the four supported branches got patches. Dates per endoflife.ai and php.net.

Does updating WordPress, Drupal or Magento update PHP?

No. Updating your CMS, plugins or themes does not update PHP. PHP is the runtime underneath the CMS, usually managed by your hosting provider or IT team. A fully up-to-date WordPress site can still sit on a vulnerable PHP version.

This matters because the October 2026 flaws are not a WordPress, Drupal, Joomla or Magento bug. Researchers confirmed unauthenticated remote code execution against Magento 2.4.9 and other PHP applications, all through the interpreter itself. If you're weighing a move, see why teams choose Kentico over WordPress.

What CMSs don't use PHP?

Many enterprise and modern CMS platforms run on other languages and are not exposed to PHP runtime flaws. The most common alternatives are built on .NET, Java, Node.js or Python, or are delivered as SaaS.

CMS / DXP	Runtime
Xperience by Kentico	.NET
Sitecore	.NET
Optimizely CMS	.NET
Umbraco	.NET
Adobe Experience Manager	Java
Strapi, Ghost, Payload	Node.js
Wagtail, Django CMS	Python
Contentful, Contentstack, Sanity	SaaS (headless)

For comparison, WordPress, Drupal, Joomla, Magento (Adobe Commerce), TYPO3 and Craft CMS all run on PHP.

What is PHP vs .NET?

PHP is a scripting language built for web pages; .NET is Microsoft's open-source development platform, most often used with the C# language. Both power websites and CMSs, but they differ in how code runs, how it is typed and where it is typically hosted.

	PHP	.NET
What it is	Server-side scripting language	Development platform and runtime (C#, F#, VB)
Maintained by	PHP project, PHP Foundation	Microsoft, .NET Foundation
How code runs	Interpreted per request, with bytecode caching (OPcache)	Compiled to intermediate code, then JIT-compiled to machine code
Typing	Dynamic, with optional type declarations	Static (C#)
Typical hosting	Linux shared or managed hosting, Apache or Nginx	Windows, Linux or containers; Azure and other clouds
Common CMSs	WordPress, Drupal, Joomla, Magento	Xperience by Kentico, Sitecore, Optimizely, Umbraco
Typical fit	Blogs, small-to-mid sites, low-cost hosting	Enterprise sites, complex integrations, Microsoft-centric IT

Neither is inherently more secure. Both receive regular security patches, and either one becomes a risk when it is left unpatched or past end of support. But enterprise .NET platforms are often full digital experience platforms (DXPs) rather than standalone CMSs.

Does Kentico use PHP?

No. Xperience by Kentico and Kentico Xperience 13 are built on Microsoft .NET, not PHP, so CVE-2026-109618 and CVE-2026-109619 do not affect them. That said, .NET receives its own regular security patches, and every platform must be kept current regardless of language. Learn more about Kentico and its approach to platform security.

Does switching away from PHP make a website secure?

No. Changing language removes exposure to PHP-specific flaws, but every runtime eventually has critical vulnerabilities. Lasting security comes from three habits:

Know what you run. Keep an inventory of every site, runtime and owner.
Build protection into the platform. Prefer built-in security over plugins of unknown origin.
Have support in place before you need it. A vendor with a clear support lifecycle that ships fixes and answers the phone matters most on a bad day.

Xperience by Kentico builds two-factor authentication, single sign-on (Microsoft Entra ID, Okta, Auth0) and role-based permissions into the platform. Kentico is ISO 27001 certified and SOC 2 Type II audited. Xperience by Kentico SaaS adds 24/7 monitoring, encrypted backups and platform updates as part of the service.

Frequently Asked Questions.

No. Prompt engineering is primarily a communication skill. Understanding what an AI model needs to produce a useful result (clear task definition, relevant context, format instructions, and appropriate constraints) does not require programming knowledge. Non-technical marketers, content strategists, and operations professionals regularly become effective prompt engineers through practice and iteration.

A good prompt is specific about what is being asked, provides the context the model needs to interpret the request correctly, specifies the format and tone of the expected output, and sets any relevant constraints (what to avoid, what not to assume). Testing and iteration are fundamental to good prompt design: the first version of a prompt is rarely the best version, and small wording changes can produce meaningfully different results.

A system prompt is a set of instructions given to an AI model before the user interaction begins. It defines the model's role, operating constraints, tone, and behavioral rules for the entire session or workflow. System prompts are how agentic AI tools, including the agents in the AIRA Agentic Marketing Suite, are configured to behave appropriately for a specific organizational context. Users typically do not write system prompts themselves; they are set by administrators or platform configuration.

Asking an AI a question is a single interaction with no particular structure. Prompt engineering is a deliberate practice: it involves understanding how the model processes input, designing prompts that consistently produce useful output, testing variants, and refining over time. The difference becomes most apparent at scale: when the same task is performed repeatedly, a well-engineered prompt produces consistently better results than an improvised question.

Prompts are partially portable. The underlying principles (clarity, context, format specification, constraint setting) apply across all major language models. However, different models respond differently to the same phrasing, and a prompt optimized for one model may need adjustment to perform equally well on another. Testing prompts on the specific model they will be used with is good practice, particularly for high-volume or high-stakes use cases.

Prompt injection is a security concern where malicious instructions are embedded in content that an AI agent reads and processes, causing the agent to perform unintended actions. For example, a web page an AI agent is instructed to summarize might contain hidden text telling the agent to ignore its instructions and do something else instead. Marketers using AI agents that read external content (web pages, user submissions, third-party documents) should be aware that the platforms and agents they use need to be designed with prompt injection safeguards in place.