PHP in 2026: Why Everything You Think You Know About PHP Is Out of Date
Direct answer: Yes, PHP is still relevant in 2026. It runs roughly 70% of websites whose server-side language is known (W3Techs, mid-2026), and today's PHP is fast, strictly typed and actively developed, with a major release every November. Most criticism of PHP describes PHP 5, a version that stopped receiving security fixes in 2018.
I run engineering at MarginTop Solutions, and most of our production systems are PHP. Hardly a month goes by without a client, a candidate or another founder asking some version of "isn't PHP dead?" This post is my long answer. It's also the hub for a series on where PHP is today and where it's going.
The reputation PHP earned, and why it's outdated#
PHP's bad reputation was earned honestly. The PHP many developers remember from the 2000s had:
- No real type system:
0 == "a"wastrue(it'sfalsesince PHP 8), and functions accepted anything. mysql_*functions that made SQL injection the default outcome.- Inconsistent function names and argument orders (
strpos($haystack, $needle)vsarray_search($needle, $haystack)). - Slow execution, no package manager, and codebases where HTML, SQL and logic lived in the same file.
All of that is true about PHP 5. Almost none of it describes PHP 8. The problem is that reputations update far more slowly than languages do.
How PHP changed: 2015 to 2026#
| Release | Year | What changed |
|---|---|---|
| PHP 7.0 | 2015 | New engine (PHPNG), roughly 2× faster than 5.6, scalar type declarations and return types |
| PHP 7.4 | 2019 | Typed properties, arrow functions, preloading |
| PHP 8.0 | 2020 | JIT compiler, union types, attributes, named arguments, match, nullsafe operator |
| PHP 8.1 | 2021 | Enums, readonly properties, fibers (the base for async), never type |
| PHP 8.2 | 2022 | Readonly classes, DNF types, standalone true/false/null types |
| PHP 8.3 | 2023 | Typed class constants, #[\Override], json_validate() |
| PHP 8.4 | 2024 | Property hooks, asymmetric visibility, lazy objects, an HTML5 DOM parser |
| PHP 8.5 | 2025 | Pipe operator |>, clone-with, a URI extension, #[\NoDiscard] |
| PHP 8.6 | Nov 2026 | Partial function application, clamp(), a Duration class, a native polling API |
Look at that list again without the word "PHP" on it. Enums, union types, a pipe operator, property accessors, partial application: that's the feature set of a modern, opinionated language, delivered on a predictable yearly schedule.
Five things you probably need to update#
1. "PHP is slow"#
PHP 7 roughly doubled performance over PHP 5. On top of that, long-running runtimes like Laravel Octane on Swoole or FrankenPHP keep the application booted in memory between requests, which removes framework bootstrap from every request. For typical web workloads, the database is the bottleneck far more often than PHP is. I cover the options in PHP runtimes explained, and our production setup in Laravel Octane + Swoole for concurrent load.
2. "PHP has no type system"#
Modern PHP has scalar, union, intersection and DNF types, enums, readonly classes and typed constants, enforced at runtime. Static analysers like PHPStan and Psalm add generics through docblocks and catch whole classes of bugs before deploy. The full story is in how PHP's type system grew up.
3. "PHP code is spaghetti"#
Composer (2012) gave PHP one of the most usable package ecosystems around. PSR standards made libraries interoperable. Laravel and Symfony brought dependency injection, queues, migrations and testing as defaults. Bad PHP still exists, and so does bad code in every language.
4. "PHP can't do async or real-time"#
Fibers arrived in PHP 8.1. Swoole, ReactPHP and AMPHP run event loops in production, and PHP 8.6 adds a native polling API. True engine-level async is still being designed, and I give an honest account of where it stands in PHP async in 2026.
5. "PHP is insecure"#
The language ships prepared statements, modern password hashing (password_hash()) and the Sodium crypto library in core. The runtime still has bugs, as October's PHP2Shell vulnerability showed, but how the project handled it was a model of coordinated disclosure. The bigger risk is running an unsupported version: only 8.2 and later get security fixes today, and 8.2's support ends on December 31, 2026. I go through the long view in PHP's runtime vulnerability history.
Who actually runs PHP#
- The long tail of the web: WordPress alone powers a large share of all websites, and Drupal, Magento and Moodle add many more.
- Large platforms: Wikipedia runs on PHP (MediaWiki). Facebook grew up on PHP and evolved it into Hack.
- Product companies and agencies: Laravel and Symfony power SaaS products, fintech back offices, marketplaces and internal tools all over the world, including the systems we build at MarginTop for clients running devices, payments and multi-tenant platforms.
One honest caveat: W3Techs counts detected sites, not engineering teams or new projects. PHP's share of new startups is smaller than its share of the web. Both numbers are true, and they answer different questions.
Why it matters to revise what you know#
- For engineers: if your mental model is PHP 5 or 7, you're writing more code than you need to. Property hooks, enums and the pipe operator remove whole categories of boilerplate.
- For CTOs and founders: stack decisions based on 2010 reputations are expensive. We wrote about this trade-off in why we chose Laravel over Node.js.
- For anyone running PHP in production: staying on old versions now has a hard cost. No security fixes, no performance gains, and a harder upgrade the longer you wait. See the upgrade playbook.
Where PHP still falls short#
A fair picture includes the gaps:
- No native generics. Static analysers fill the gap, but the runtime doesn't enforce them.
- Async isn't first-class yet. You choose an extension or library; the core language doesn't have
async/await. - Legacy baggage. Some standard-library inconsistencies remain for backward compatibility.
- Perception. Hiring senior engineers who want to write PHP can be harder in some markets than the language deserves.
The series#
This post is the hub. Each of these goes deeper:
- PHP 8.6: what's new and the RFCs to watch
- PHP 8.5 features that matter in production code
- Property hooks and asymmetric visibility in PHP 8.4
- How PHP's type system grew up
- PHP runtimes explained: FPM, Octane, FrankenPHP, Swoole, RoadRunner
- PHP async in 2026: fibers, coroutines and native async
- PHP2Shell: how the PHP team contained a critical RCE
- Runtime-level PHP vulnerabilities and what they have in common
- Upgrading a legacy PHP 7 app to PHP 8.5
- TypePHP and the future of PHP performance
Key takeaways#
- PHP still powers roughly 70% of websites with a known server-side language, and it ships a new release every November.
- Most criticism of PHP describes PHP 5. PHP 8 has strict types, enums, property hooks, a pipe operator and a JIT.
- Performance is rarely PHP's problem today. Long-running runtimes like Octane and FrankenPHP remove bootstrap cost entirely.
- The real risk is running an old version. Only PHP 8.2+ is supported, and 8.2's security support ends December 31, 2026.
- PHP still lacks native generics and first-class async, so evaluate it honestly, not by reputation.
Sources#
- W3Techs: usage statistics of PHP
- php.net: supported versions
- php.net: PHP 8.5 release notes
- PHP RFC index
Deciding whether PHP is right for your next product? Get in touch. We'll give you an honest answer, even if it's "use something else."