Techsplaining 101: PHP and PHP2Shell
What is PHP? Why is everyone suddenly talking about it? Find out more in our long-running series: Techsplaining 101.
Techsplaining 101: PHP and PHP2Shell
What is PHP? Why is everyone suddenly talking about it? Find out more in our long-running series: Techsplaining 101.
If you’ve been online for the last couple of weeks, you’ve probably seen a few posts, news articles, or videos about something called a “PHP CVE.” On Wednesday, Oct. 21, security researchers published their findings of a huge flaw in PHP that could potentially lead to cybersecurity incidents for anyone running PHP - and so for much of that week, the technology community collectively scrambled to update their PHP packages so that the vulnerability wouldn’t be exploited by bad actors.
Let’s take a look at this technology, learn what it actually means when there’s a huge vulnerability in a common piece of tech, and figure out what, if anything, you need to do in light of the Oct. 21 report.
What is PHP, and why do I keep hearing about it?
PHP is, at its core, a scripting language installed and used on web servers, meaning it’s primarily used for web development. Many, many websites and applications run on PHP; in fact, according to W3Techs, PHP underpins 75 percent of all websites as of 2025. Even if that number is inflated or has changed somewhat since the statistic was published, that’s the vast majority of the internet.
And Miami is no exception. All of our Laravel web apps are written in PHP. These applications include things that would be familiar to a non-technical Miami user, including:
- Courselist
- Registration Override
- Parent and Family Information
- MyCourses
As you can tell, PHP is responsible for some incredibly important information and functionality here at Miami, and so when things in the world of cybersecurity got a little stressful in mid-October, it was very much an all-hands-on-deck situation.
What does ‘CVE’ mean?
CVE stands for “common vulnerabilities and exposures” or “common vulnerability enumeration” and is essentially a naming system for identified security vulnerabilities. The system provides a standardized way to talk about these vulnerabilities so that security professionals have that shared language.
The PHP vulnerability published on Oct. 21 is actually a combination of two separate CVEs: CVE-2026-109618 and CVE-2026-109619, colloquially known as PHP2Shell. As soon as the vulnerability was identified by security researchers, the PHP organization published updates that needed to be installed immediately in order to remediate the issues.
What do I need to do about all this?
So, you’re probably asking yourself: What do you need to do with all of this information about PHP and CVEs? If you aren’t responsible for the server-side, non-content details of a website: nothing!
You also don’t have to worry about Miami sites and applications, because the technology community here at Miami showed up and worked together to get everything patched.
IT Services employees (including members from the Linux, networking, application operations, Windows, and development teams) and distributed community members from the regional technology office, the libraries, and the academic divisions all banded together to get updates to the various servers and apps. Under the direction of the Information Security Office, patches were applied where possible, and some servers had to be powered down or removed from direct internet access.
Some investigation is ongoing, but suffice it to say: Our detection tools and incident response procedures allowed us to mobilize quickly and keep Miami data safe.