What happened to PHP? Why a 30-year-old technology still matters

Created in the mid-1990s, the programming language helped power the first generation of dynamic websites and became a foundation of the online world. As newer languages such as Python and JavaScript gained popularity, PHP largely faded from the spotlight.

Yet recently, it has found itself back in the headlines. Security vulnerabilities affecting websites and web applications have highlighted just how much of today's digital infrastructure still depends on technology that was built years, and sometimes decades, ago.

Even though it was created more than 30 years ago, PHP never really went away.

What is PHP?

PHP, short for Hypertext Preprocessor, is a server-side programming language used to build websites and web applications.

Most internet users will never see PHP directly, but many interact with it every day. It powers content management systems, e-commerce platforms, customer portals and business websites across the world. Most notably, PHP remains the backbone of WordPress, the world's most widely used website platform.

Why is PHP back in the news?

The recent headlines reflect growing concerns around the security of web applications and legacy software.

Whether the issue involves vulnerabilities in PHP-based applications, outdated website plugins, unsupported software versions or weaknesses discovered by security researchers, the common theme is the same: organisations continue to depend on systems that require constant maintenance and protection.

This is particularly important because PHP's footprint remains enormous. Millions of websites and online services still rely on PHP-based infrastructure. When a vulnerability is identified, organisations that fail to update or patch their systems can quickly become targets for cybercriminals.

The growing cybersecurity challenge

Most organisations do not replace old systems overnight. Instead, they add new technologies on top of existing foundations. Cloud computing, artificial intelligence (AI) and modern applications often sit alongside legacy software and databases. Technology often remains in use far longer than expected, meaning businesses must secure not only the latest innovations but also the infrastructure they already depend on.

This creates increasingly complex technology environments and expands the number of potential entry points for attackers.

AI is making that challenge even greater. While AI is helping businesses improve efficiency and automate processes, it is also giving cybercriminals new tools. According to CrowdStrike's 2026 Global Threat Report, attacks by AI-enabled adversaries increased by 89% year-on-year. [1]

As organisations secure a growing number of applications, identities and automated systems, cybersecurity is increasingly becoming a requirement for digital innovation rather than an optional expense.

Why this matters for investors

PHP's continued relevance highlights an important investment lesson.

Much of the discussion around technology focuses on what comes next. However, digital transformation is not only about adopting new technologies; it is also about protecting existing infrastructure.

Cybercriminals need only one point of entry, while organisations must secure every potential vulnerability. As a result, cybersecurity spending is increasingly viewed as a business necessity.

The cost of failure can be substantial. Global cybercrime damages are estimated at $10.8 trillion in 2026 and are projected to rise to $16 trillion by 2029.[2] Against this backdrop, Bloomberg consensus estimates suggest cybersecurity sector sales per share could increase by more than 75% between 2024 and 2028.[3]

An old technology with a modern lesson

The story of PHP is not really about a programming language. It is a reminder that technological progress does not replace the past; it builds on it.

As organisations balance legacy infrastructure with emerging technologies such as AI, the need for cybersecurity continues to grow. For investors, that creates a compelling dynamic: some of the most attractive opportunities may arise not just from the newest technologies, but from the need to protect the systems that underpin the digital economy.

 
[1] CrowdStrike 2026 Global Threat Report, reported by Benzinga, 24 February 2026 IMF comments on the potential financial system implications of extreme cyber incidents, reported by Benzinga, 9 May 2026.
[2] Statista, 2026. Assumptions, opinions, and estimates are provided for illustrative purposes only. There is no guarantee that any forecasts made will come to pass.
[3] L&G, Bloomberg.in USD ISE Cyber Security UCITS Net Total Return Index as 23rd of September 2026. Assumptions, opinions, and estimates are provided for illustrative purposes only. There is no guarantee that any forecasts made will come to pass.