5 days after emergency fixes shipped, 93.6% of measurable PHP instances are still exposed
On October 21, the PHP project shipped emergency releases for PHP2Shell, a pair of critical flaws (CVE-2026-109618 and CVE-2026-109619) that give an unauthenticated attacker remote code execution inside the PHP engine itself. Security agencies issued urgent advisories, and some organizations pulled systems offline while they worked out their exposure.
In our first report, we found that 99.3% of the PHP instances we could measure were still unpatched after 24 hours. We kept watching. As of October 26, five days after disclosure, the picture has barely shifted – 93.6% still exposed. That’s roughly 15 out of every 16 hosts we can measure.
Approximately 1.33 million affected hosts run end-of-life PHP branches that no longer receive official fixes. For these systems, remediation may require a version update as well.
What we Measured
OX Security ran repeated Shodan queries from the first evening after disclosure through October 26, 2026. We classified each host by the PHP version it advertises publicly.
Hosts that hide their PHP version cannot be classified and are left out of every affected-versus-patched figure in this post.
Day by day: how far did patching get?
Our first scan, on the evening of October 21, found 2,224,364 PHP instances on Shodan. Of the 1,991,515 we could place in the affected range, only 245 were already on a fixed release. Five days later, that number is 127,430. That’s progress – a slow one.
| Snapshot | PHP instances on Shodan | Measurable, affected range | Still unpatched | Patched | % unpatched |
| Oct 21 (first scan) | 2,224,364 | 1,991,515 | 1,991,270 | 245 | 99.99% |
| Oct 22 | 2,206,457 | 1,974,890 | 1,960,739 | 14,151 | 99.28% |
| Oct 23 | 2,195,192 | 1,964,413 | 1,921,435 | 42,978 | 97.81% |
| Oct 24 | 2,204,502 | 1,972,648 | 1,889,468 | 83,180 | 95.78% |
| Oct 25 | 2,197,391 | 1,965,956 | 1,863,755 | 102,201 | 94.80% |
| Oct 26 | 2,226,122 | 1,990,772 | 1,863,342 | 127,430 | 93.60% |
No segment we measured has patched even a quarter of its affected hosts.
| Segment | Hosts found (PHP version visible) | Still unpatched | Patched | % unpatched | Unpatched on EOL PHP (≤8.1) |
| cPanel | 2,210 | 528 | 0 | 100.00% | 528 |
| Magento | 114 | 50 | 0 | 100.00% | 49 |
| Drupal | 6,017 | 3,687 | 203 | 94.78% | 3,248 |
| phpMyAdmin | 34,182 | 28,086 | 1,567 | 94.72% | 5,854 |
| WordPress | 42,404 | 32,833 | 2,228 | 93.65% | 16,547 |
| Joomla | 1,470 | 631 | 51 | 92.52% | 366 |
| Laravel | 2,323 | 1,804 | 389 | 82.26% | 229 |
Conclusion: we missed the opportunity to get patches out the door
Remediation is too slow, while everyone panics about PHP CVEs, remediation isn’t in panic state, it barely crawls, with more headlines than fixed instances in the wild.
PHP2Shell is one of the most covered vulnerabilities of the year, and five days after the fix shipped, 93.6% of measurable instances are still exposed.
While everyone were looking at the “Steal My Bitcoin” challenge – giving a reward in the form of Crypto for whoever successfully exploits their PHP vulnerable site, we missed the opportunity to actually get our patches out the door – and now, when exploits are out there, proven in the wild and not just a speculation – we’ve left our most precious assets exposed for the next hacker to take advantage of.
