LIVE PHP2Shell
101,550,763
Click to copy
websites potentially exposed to PHP2Shell
An estimate of PHP websites still running a version below the fix for CVE-2026-109618 / CVE-2026-109619 while exploitation attempts are being reported. [source] Unpatched means exposed. It does not mean confirmed breached.
1,613,139 internet-facing PHP services measured running unpatched PHP Click to copy
1,249,270 PHP services running end-of-life PHP (8.1 or older), which PHP itself no longer fixes Click to copy
PHP services seen running a patched release
Shodan banners showing 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later, among PHP services scanned since 22 Oct 2026 that show their PHP version
38,652 11.70% of 330,492 services
Count
Share patched
Show the data
Measured Patched services Share patched Services in sample
Copy link Copy stat Share Post
Measured 23 Oct 2026, 05:11 UTC · next update soon
101,550,763 websites unpatchedCVE-2026-109618 · CVE-2026-109619 CVSS v4.0 9.2 critical Unauthenticated RCE in the PHP engine Fixed: 8.5.12 · 8.4.27 · 8.3.36 · 8.2.35 1,249,270 services on EOL PHPExploit attempts seen since 17 Oct Patch now · sireninfo.net/patch.html
How it's counted: every 5 minutes, Shodan measures the share of internet-facing PHP services whose headers show an unpatched version (88.30% of 330,492 scanned since 22 Oct 2026). The sample starts on 22 October, the first full day after the fix shipped, so it holds no banners collected before a fix existed. That share is applied to the 115,000,393 PHP websites counted by Censys (updated 21 Oct 2026) [source] . One server often hosts many sites, which is why websites outnumber services. Shodan counts every IP address and port separately, so a server answering on ports 80 and 443 counts twice in the services figures; the share is unaffected.
Patched releases: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Everything below 8.2 is end-of-life and counted as unpatched. Ubuntu builds that carry the fix under their old version number are left out of the sample, because their banners can't show whether they're patched. Some vendors fix older versions without changing the version number (Red Hat, CloudLinux, SUSE LTSS, DirectAdmin and others). Those can't be told apart from unpatched servers, so they count as unpatched and the estimate may run high. Shodan revisits servers about weekly, so the measured share trails real-world patching by days. For comparison, Palo Alto Unit 42 counts 22.6 million exposed instances [source] and Censys sees 6.3 million PHP hosts. [source] Servers that hide their PHP version can't be measured, so they are assumed to patch at the same rate as those that show it.
php.net advisory · Technical write-up · Patch commands · Siren Security blog · RM Cyber