PHP execution is the server-side interpretation of PHP code by the web server or PHP runtime. When a file with PHP content is placed in an executable location, the server does not treat it as a harmless upload; it runs the code. In security terms, that means an attacker can turn an uploaded file into active malware, often a web shell that accepts commands, alters content, or steals data.
This matters because file upload flaws become far more severe when uploads land in web-accessible paths with PHP enabled. A simple filename check is not enough if the server will still execute the file after upload. Defenders reduce the risk by storing uploads outside the web root, disabling script execution in upload directories, enforcing strict server-side file validation, and allowing only the file types a feature truly needs. In attacks, PHP execution is often the final step that converts an upload bug into remote code execution.