PHP: How a Set of Résumé Tools Became the Web's Workhorse

Few programming languages started as modestly as PHP. In 1994 Rasmus Lerdorf wrote a few CGI binaries in C to count visits to his online résumé. Three decades later the language he started runs a large share of the web, from WordPress sites to Laravel applications. Its history is a story of rewrites, a performance race and, more than once, security trouble.

PHP: The Web's Workhorse Language follows that path. These are some of the moments that shaped it.

From personal tools to a real language

Lerdorf announced the Personal Home Page Tools on Usenet in 1995, which opened the project to outside users. PHP/FI 2.0 followed in 1997 with a form interpreter and database support. The big change came in 1998, when Andi Gutmans and Zeev Suraski rewrote the parser for PHP 3.0. It was the first version that looks like modern PHP, and the name became the recursive acronym PHP: Hypertext Preprocessor.

The Zend Engine and the hosting boom

Gutmans and Suraski then built the Zend Engine and founded the company Zend around it. PHP 4.0 was built on that engine in 2000 and brought better performance and session support. It spread across shared web hosting, and soon after came the projects that kept PHP busy for years: WordPress in 2003 and Facebook in 2004.

A stalled branch and a speed race

In 2010 the developers gave up on PHP 6 and its native Unicode support after years of work, and the version number was skipped. That same year Facebook announced HipHop for PHP, which compiled PHP to C++. The performance race it started led to HHVM and, in time, to PHP 7.0 in 2015. With the PHPNG engine rewrite and scalar type declarations, PHP 7 was much faster than PHP 5 and gave the language new life. Laravel, first released in 2011, and Composer, from 2012, helped give PHP a more modern image.

A steady modern cadence

PHP 8.0 arrived in 2020 with a JIT compiler, attributes, union types and the match expression. In 2021 attackers pushed two malicious commits to the php-src repository on the project's own git server, and the team moved the canonical repository to GitHub. The PHP Foundation was announced the same year to pay core contributors. Since then a major release has shipped about once a year, including property hooks in 8.4 and the pipe operator in 8.5.

PHP2Shell

This month brought a fresh test. On 20 October 2026, details and an exploit tool for two critical remote-code-execution flaws leaked a day ahead of the planned patches. PHP released fixes on 21 October in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.