# PHP2Shell, measured: 86% of PHP servers on end-of-life branches Of 380,608 web servers that name their PHP version, 14.1% run a branch with a PHP2Shell fix and 72.8% an affected branch php.net no longer releases. PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21 to fix two critical flaws that can let an unauthenticated request run code on the server, CVE-2026-109618 and CVE-2026-109619 ([php.net's advisory](https://www.php.net/archive/2026.php#2026-10-21-5)). Wiz, which reported them and named them PHP2Shell, says every PHP version back to 5.4 is affected by at least one ([Wiz's write-up](https://www.wiz.io/blog/php2shell-php-rce)). php.net rates the risk highest for mod_php, PHP running inside Apache, where an exploit has been shown to fire before any application code runs. We counted with [Web IP](https://internetdata.io/databases/web-ip), which holds every host that answered on port 80 or 443 in our internet-wide scans, with its HTTP Server header and the names of the cookies it set. The newest scan of each host, taken between October 6 and October 21, the day the fixes shipped, has 55,005,697 addresses answering HTTP. 1,008,657 of them show PHP, by naming it in the Server header or by setting a `PHPSESSID` cookie, and 380,660 name their PHP version. Those 380,660 are mod_php servers. PHP inside Apache adds its version to Apache's own header, as in `Apache/2.4.6 (CentOS) PHP/5.4.16`, and all but 80 of them say Apache. ## Which branches they run | PHP branch | Servers | php.net release with the fix | |---|---|---| | 8.2 to 8.5 | 53,535 (14.1%) | 8.2.35, 8.3.36, 8.4.27, 8.5.12 | | 5.4 to 8.1 | 277,171 (72.8%) | None, end of life | | Before 5.4 | 49,902 (13.1%) | None, end of life since 2014 or earlier | php.net no longer releases 8.1 or anything older. For this fix it published minimal source patches for 7.4, 8.0 and 8.1, for anyone who builds PHP themselves, and gave Linux distributions and long-term support vendors the patches in advance. The largest branches are 5.4 with 81,508 servers, 7.4 with 47,955, 5.6 with 42,356, 8.2 with 40,058 and 7.2 with 32,728. ## PHP 5.4 is CentOS 7 70,616 of the 81,508 servers on PHP 5.4 name CentOS in the same header, and 74,157 run 5.4.16, the version CentOS 7 shipped. CentOS 7 reached its end of life in June 2024, so no CentOS update is coming for them. Across every branch, 153,539 of the 380,660 (40.3%) name CentOS. ## A supported branch isn't a current one Of the 53,535 servers on 8.2 to 8.5, 1,652 (3.1%) ran their branch's September 24 release, the newest before the fix. The two largest single versions on those branches are 8.2.12 with 15,646 servers and 8.2.8 with 14,351, released in October and July 2023. 10,346 of the 8.2.8 servers sit in one company's network. ## Where they sit Of the 327,073 servers on a branch with no release, 158,196 are on hosting networks and 150,369 on ISP networks, the rest on education, business and government networks. Amazon's two networks, AS16509 and AS14618, hold 46,440 of them (14.2%). The oldest are mostly a few legacy fleets: a single US network answers with PHP 4.4.0 from 11,960 addresses. ## A version string isn't a patch level Debian, Ubuntu and Red Hat backport security fixes into their own builds and keep the version number, and long-term support vendors patch end-of-life branches the same way. So a server announcing an old version may already be fixed, and one that hides its version may not be: another 627,997 show PHP by its session cookie alone. This post counts what servers announce, never which are vulnerable. ## Where the first attempts came from AWS saw a PHP2Shell exploit attempt on its MadPot honeypots on October 17, four days before the disclosure, from an address it ties to "a commercial anonymization network". It published that address and five more it saw on October 21 ([AWS's post](https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/)). We looked up all six in our builds from the day AWS saw each: - All six are in [Hosting IP](https://internetdata.io/databases/hosting-ip), five at `high` confidence and one at `medium`. - Four are in [VPN IP](https://internetdata.io/databases/vpn-ip), all exits of consumer VPN services, three at `high` and one at `low`. The October 17 address is one of the three. - Two are in [Datacenter Proxy IP](https://internetdata.io/databases/datacenter-proxy-ip) and two in [Residential Proxy IP](https://internetdata.io/databases/residential-proxy-ip). Six addresses aren't a detection rate. AWS calls them shared infrastructure, to investigate rather than block, which is what a hosting or VPN flag on a request is for. ## Finding PHP in your own ranges Web IP's `server` column has each host's Server header, so a filter on `PHP/` over the ranges you own or protect, grouped by the version that follows, lists the servers announcing one. `set_cookie_names` finds the ones that don't: a `PHPSESSID` there is PHP. Joined to [IP ASN](https://internetdata.io/databases/ip-asn), the same filter counts them by network, as above. We did the same for mail servers after [Exim 4.100.1](https://internetdata.io/blog/exim-4-100-1). ## How we counted We took the newest Web IP row of each address on ports 80 and 443 that returned an HTTP response, and read the PHP version from the Server header, the newer of the two ports where both name one. PHP counts as shown when the header names it or the response sets `PHPSESSID`. A branch is the version's first two numbers, and the shares leave out the 52 servers naming a branch PHP never released, such as 6.0. A server's network is its address's origin network in IP ASN, typed by [ASN](https://internetdata.io/databases/asn). AWS's six addresses are matched against the Hosting IP and VPN IP builds of the day AWS saw each, and the proxy databases' 90-day windows of that day. ## Getting access Web IP is a gzipped CSV download, and [its docs](https://docs.internetdata.io/database/web-ip) list the columns. To license it, see [pricing](https://internetdata.io/pricing) or [talk to us](https://internetdata.io/contact).