Live · PHP2Shell
114,542,738
websites potentially compromised by PHP2Shell
An estimate of PHP websites still running a version below the fix for CVE-2026-109618 / CVE-2026-109619 while exploitation is in the wild. Unpatched means exposed. It does not mean confirmed breached.
1,897,783 servers measured running unpatched PHP
1,302,933 machines running end-of-life PHP (8.1 or older), for which no fix exists
Measured 21 Oct 2026, 21:05 UTC · next update soon
How it's counted: every 5 minutes, Shodan measures the share of internet-facing PHP servers whose headers show an unpatched version (99.60% of 447,030 servers scanned since 20 Oct 2026). That share is applied to the 115,000,393 PHP websites counted by Censys (updated 21 Oct 2026) . One server often hosts many sites, which is why websites outnumber servers.
Patched releases: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Everything below 8.2 is end-of-life and counted as unpatched. Ubuntu builds that carry the fix under their old version number are left out of the sample, because their banners can't show whether they're patched. Shodan revisits servers about weekly, so the measured share trails real-world patching by days. For comparison, Palo Alto Unit 42 counts 22.6 million exposed instances and Censys sees 6.3 million PHP hosts.
php.net advisory · Patch commands · Siren Security blog · RM Cyber