PHP2Shell: 93.6 percent of exposed PHP servers still unpatched after five days

Five days after two paired PHP vulnerabilities were disclosed, almost nothing has been patched. The New Stack reports that Ox Security put the exposed share at 93.6 percent on Monday. The paired bugs are called PHP2Shell, filed as CVE-2026-109618 and CVE-2026-109619. Their combined severity score is 9.2 out of 10. About 70 percent of websites with an identified server-side language run PHP. A US federal remediation deadline hits on Thursday, October 29, 2026.

What the security firms counted

Ox Security's own blog post is the source of the 93.6 percent figure. The New Stack quotes Moshe Siman Tov Bustan of Ox Security. He said that the panic has not turned into patching. Ox also wrote that remediation is not in panic state and barely crawls. The share counts exposed PHP services still on vulnerable versions. The reading is as of October 26.

Censys says about 11.2 million internet-facing PHP services report patched versions. Censys cautions that its counts rely on reported version numbers. Linux distributions often back-port fixes without changing the version. Some servers that look vulnerable may already be safe. Another 32.5 million still show unsafe PHP versions. Censys does not know what another 61.3 million services run.

The deeper problem is unsupported PHP

Flare tracked 2.2 million PHP service records on October 22. Nearly three quarters advertise a PHP branch no longer supported by the PHP project. Mallory tracked 2.6 million services and found about 1.9 million on unsupported branches. That is 73.5 percent of the services it surveyed. These servers get no official patch. The only fix is a version upgrade.

Ramy Rahman at ArmorCode told The New Stack that an upgrade brings extra work. The team has to deal with compatibility issues or ask a vendor for a supported fix. The New Stack says the US CISA added PHP2Shell to its Known Exploited Vulnerabilities catalog. US federal civilian agencies must remediate by Thursday, October 29. Private companies are not covered by that deadline.

Attacks are already in production

Cloudflare CEO Matthew Prince posted on X about the attack curve. His network saw thousands of exploit attempts in the ten hours before public disclosure. In the 45 minutes after disclosure the count jumped to tens of thousands. Within two hours it hit hundreds of thousands. The number is in the millions now.

Adel Karimi at Perplexity AI runs honeypots. He told The New Stack his honeypot recorded confirmed remote code execution. The target was a vulnerable Apache mod_php installation on PHP 8.4.26. Karimi said his single-worker setup was deliberately favorable to attackers. The Wikimedia Foundation and the Internet Archive took servers offline during the window. Two long-running Japanese mobile games closed down permanently. Most PHP operators have done neither. The honest step today is to check which PHP version each production service runs. The next step is to budget a version upgrade for the ones with no patch.

Source

"The panic hasn't turned into patching": What security researchers really think about the PHP2Shell response, The New Stack. PHP2Shell day 5: the panic hasn't turned into patching, Ox Security.