PHP security report

What PHP2Shell exposure counts can tell website owners

Researchers counted millions of publicly visible PHP installations after the October 21 security release. Those measurements show how widely administrators need to check PHP. They cannot tell a website owner whether their own server has the fix, because the studies count different things and cannot see every vendor backport.

By PHPFixes · Published and sources checked October 23, 2026

On October 23, W3Techs reported PHP on 69.3% of websites whose server-side language it could identify. Among PHP sites, its broad version groups were 65.3% on PHP 8, 26.9% on PHP 7, 7.7% on PHP 5 and 0.1% on PHP 4.

The denominator matters: 69.3% applies to sites with an identified server-side language. It does not mean 69.3% of internet-connected machines are vulnerable. Nor does the broad “PHP 8” category distinguish an affected package from a fixed one.

Host counts include systems with no visible version

VulnCheck’s October 21 report, checked again on October 23, identifies 2,608,039 internet-facing hosts running PHP. It lists 1,474,985 hosts showing a version below an upstream fixed release and 1,133,000 with no disclosed PHP version. The two category figures add to 54 fewer than the stated total; the report does not explain the difference.

A hidden version leaves the package status unknown to that measurement. It is not evidence that the server lacks an update. Several websites can also share one host, so this total cannot be directly compared with W3Techs’ website share.

What the widely repeated 99.3% figure measures

OX Security’s October 22 study used PHP version information visible in Shodan’s index. It reported these counts of hosts displaying one of the new fixed upstream versions:

Scroll sideways to see all columns.

OX Security’s published first-day observations
Observation	Hosts showing a fixed upstream version
Initial measurement	245
After 12 hours	4,519
After 24 hours	14,151

Its 24-hour table also lists 1,974,890 hosts as unpatched, leading to the rounded 99.3% headline. The study excludes hosts that reveal too little version information to classify and warns that Shodan’s changing index affects comparisons.

For a hosting decision, treat this as a version-observation study. Vendor fixes can retain older PHP numbers: Ubuntu’s notice, for example, lists a fixed package beginning with 8.3.6. A measurement based only on upstream version numbers can misclassify such a package. We therefore do not present 99.3% as a verified worldwide rate of servers missing the fix.

Request counts cannot be converted into victim counts

ELLIO reports 743 requests carrying the session-upload-progress field from 33 addresses by 23:00 UTC on October 21. That is a count of requests reaching its sensors. One sender can issue many requests, and a request containing an attempted payload can fail.

Coalition separately reported exploit-related requests at 08:00 UTC that day and increased reconnaissance around the release. Together, these observations support investigating activity during the release period. They do not supply a count of businesses breached or establish how long every administrator had to act.

Older branches require a supplier check

PHP’s support schedule lists 8.2 through 8.5 as supported branches on the review date. A server on an older branch needs an exact answer from its distribution or support supplier about available security fixes. A vendor-maintained package and an unsupported original PHP build can display the same short version.

For your own server list, record confirmed fixed, confirmed affected and unresolved separately. Include the package supplier, full revision and running-service check for each host. This gives administrators specific follow-up work without borrowing certainty from an internet-wide percentage.

PHP’s maintainers describe the capacity behind the fixes

The PHP Foundation said its security team had published 15 CVEs since July 1 and handled more than 100 invalid, duplicate or unreproducible reports. It described additional staffing, changes to security decisions and the role of AI tools in checking reports. Those are figures about maintaining PHP, separate from the task of deploying its packages to websites.

How to read this snapshot

W3Techs counts websites; VulnCheck counts hosts; OX uses an external search index; ELLIO and Coalition report traffic seen by their own sensors. Their linked reports were checked on October 23. Counts from different samples and times have not been added together.

Next: read the backport and running-version guide to classify your own PHP package with evidence from its supplier.