PHP vulnerability by the numbers: millions of attacks and over a million servers still exposed
Yesterday, we explained the critical PHP vulnerability and how to update your website urgently. Twenty-four hours later, the first numbers are in, and they confirm the urgency: millions of attack attempts, and more than a million servers still vulnerable. Here is the essential PHP vulnerability by the numbers, with the source of every figure. Figures as of October 22, 2026.
The PHP vulnerability by the numbers: the essentials
9.2 / 10
CVSS 4.0 severity score of each of the two flaws
~3 million
Internet-facing PHP servers tracked by Censys on October 22
1.57 million
Unpatched PHP servers identified by Censys on October 21
Millions
Attack attempts seen by Cloudflare the day after the fix
Is your website or server running a PHP version that needs fixing?
The two flaws, CVE-2026-109618 and CVE-2026-109619 (nicknamed “php2shell”), let an unauthenticated attacker run code on a server that serves PHP web pages. Each scores 9.2 out of 10. According to the PHP project, a single request is enough in some setups (Apache with mod_php), before your site’s code even runs.
A four-day head start for attackers
| Date | What happened | Source |
|---|---|---|
| October 17 | First exploitation attempt observed by Amazon on a honeypot, four days before the fix. | Amazon, via SecurityWeek |
| October 20 | The flaw identifiers leak online; the PHP project publishes an advance notice. | SecurityWeek, Tenable |
| October 21 | Fixes PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. CISA urges immediate patching. | PHP Foundation, CISA |
| October 21-22 | Cloudflare: thousands of attempts before the announcement, tens of thousands 45 minutes after, hundreds of thousands within 2 hours, then millions. | Cloudflare, via SecurityWeek |
| October 21 | NVD assigns its own CVSS 3.1 score of 9.8 out of 10. The NSA also urges immediate patching. | NVD, NSA, via phpvulnerabilities.app |
| October 21-22 | Hadrian, Patchstack and Cloudflare see attempts hours before the fix; VulnCheck sees a Chinese IP address unsuccessfully try to install a webshell. | SecurityWeek |
| Internet-facing PHP hosts (Oct. 21) and PHP web properties | 2.58 million hosts; ~54.9 million web properties | Censys (LinkedIn post, via TipRanks) |
| Internet-facing PHP hosts, nearly all vulnerable | Over 2.6 million | VulnCheck |
| Servers on PHP 3.x–7.3 / on PHP 7.4, 8.0 or 8.1 | Over 700,000 / nearly 400,000 | VulnCheck |
| IP addresses running PHP (all versions) | ~5.1 million | VirusTotal |
| IP addresses on end-of-life PHP (5.4 to 8.1) | ~758,000 | VirusTotal |
In other words, attackers were testing the flaw before the fix even existed. Once the fix was out, it took only hours for attacks to go from thousands to millions.
How many sites and servers are exposed?
PHP runs most of the web, including WordPress. The problem: many servers still run old versions the PHP project no longer officially fixes.
| Measure | Figure | Source |
|---|---|---|
| Websites with a known server-side language that use PHP | 69.3% | W3Techs |
| PHP sites still on version 7 | 26.9% | W3Techs |
| PHP sites still on version 5 | 7.7% | W3Techs |
| Unpatched PHP servers, out of ~1.58 million showing their version (Oct. 21) | ~1.57 million | Censys |
| PHP servers on an end-of-life version | At least 1 million | VulnCheck |
| IP addresses showing a PHP version, of which on a supported version | 1.1 million, of which ~272,000 | VirusTotal |
| PHP hosts located in the United States | ~920,000 | SecurityWeek |
Counting methods differ between firms (only some servers show their version), so the figures don’t line up perfectly. But they all point the same way: the vast majority of visible PHP servers were not yet patched the day after the fix.
📊 What the numbers don’t say yet
As of October 22, the flaw was not listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog, and watchTowr says the attack code circulating doesn’t yet manage to take over a server: it crashes the target or tests its response. Amazon, however, says php2shell is “broadly exploited”. Don’t wait for reliable code to circulate: it only takes one.
Checked as of October 22, 2026: CISA’s KEV catalog (version 2026.10.21) still lists neither flaw, and no EPSS score (exploitation probability) has been published yet.
What you need to do today
- Check your PHP version with your host: you need 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or newer).
- If your site runs PHP 8.1 or older, CISA recommends taking it offline until it is upgraded.
- If your server was exposed before the update, have it checked for backdoors and change your database passwords.
At NeoTech, our server management applies these updates, and our cybersecurity services include automated 24/7 monitoring with on-call technician response. If you have a WordPress site, our website design includes up-to-date hosting.
Book your free cyber check
Don’t know which PHP version your site runs, or whether your host has patched it? The free cyber check reviews your website and servers, then hands you a clear plan, in order of priority.
Not sure the update applies to you? 👉 Request a check: does my business need the PHP update?
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Sources
- SecurityWeek: PHP2Shell Exploitation Started Days Before Patches (October 22, 2026) — data from Amazon, Cloudflare, Censys, VulnCheck, VirusTotal, watchTowr
- Censys: Oct 21 Advisory: PHP Unauthenticated Remote Code Execution
- CERT-EU: Critical Vulnerabilities in PHP, advisory 2026-018
- CISA: Critical Vulnerabilities in PHP Require Immediate Patching (October 21, 2026)
- Tenable: php2shell FAQ
- The PHP Foundation: Today’s PHP Security Release (October 21, 2026)
- W3Techs: Usage statistics of PHP for websites (October 22, 2026)
- PHP2Shell Assessments: CISA, NVD, NSA, KEV
- TipRanks: Censys PHP exposure data
- BleepingComputer: PHP ships emergency patches for PHP2Shell