An estimate of PHP websites still running a version below the fix for CVE-2026-109618 / CVE-2026-109619 while exploitation attempts are being reported. [source] Unpatched means exposed. It does not mean confirmed breached.
1,614,624internet-facing PHP services measured running unpatched PHPClick to copy
1,280,033PHP services running end-of-life PHP (8.1 or older), which PHP itself no longer fixesClick to copy
PHP services seen running a patched release
Shodan banners showing 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later, among PHP services scanned since 22 Oct 2026 that show their PHP version
98,879,784 websites unpatchedCVE-2026-109618 · CVE-2026-109619CVSS v4.0 9.2 criticalUnauthenticated RCE in the PHP engineFixed: 8.5.12 · 8.4.27 · 8.3.36 · 8.2.351,280,033 services on EOL PHPExploit attempts seen since 17 OctPatch now · sireninfo.net/patch.html
About sireninfo.net
0-days, tracked live.
sireninfo.net was created by S1REN, the online hacker, to track 0-days and live information as they are released. AI is helping researchers find critical bugs faster, and attackers are moving just as fast: for PHP2Shell, exploit attempts began four days before the fix was released. [source] This site shows what's broken, how much of the internet is still exposed, and how to fix it, updated in real time.
PHP2Shell was found with AI-assisted code auditing. Wiz credits its AI tooling [source] and Calif describes LLM-driven variant analysis. [source] More critical bugs are now being found, faster, in software almost everyone runs.
02
Attacks can start before the patch
Amazon's honeypots caught a PHP2Shell exploit attempt on 17 October, four days before disclosure, [source] and Cloudflare reported attacks hours before the fix shipped. [source] Waiting for the next patch window is no longer safe.
03
Advisories don't show exposure
An advisory tells you what's broken. It doesn't tell you how much of the internet is still running it. sireninfo.net measures that from live internet scan data and shows how fast it's being fixed.
For every 0-day we track
A live counterExposed and patched systems, re-measured every 5 minutes and charted over time.
A patch guideCopy-paste update and restart commands for every major platform.
A technical write-upHow the bug works, how to detect it, and what to do now, with every claim linked to its source.
About
sireninfo.net is built and run by S1REN. New 0-days are added as they are released and are tracked live for as long as they matter.