On 21 October 2026, the PHP project fixed two critical vulnerabilities known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619, each rated 9.2 under CVSS 4.0) [1]. Both allow attackers to execute code on the server through ordinary web requests. According to the PHP project, every installation that processes web requests is at risk, whether it runs PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP or LiteSpeed. Fixes are only available for PHP 8.2 to 8.5. Since details circulated before the scheduled release, we expect rapid exploitation. We at SecuSeek analysed how many websites and organizations are exposed and measured how fast operators patched within the first 24 hours.
For this report, SecuSeek examined more than 18 million websites worldwide and the websites of about 22,000 organizations from critical sectors, e.g., energy, health and water supply, whose patch status was measured repeatedly within the first 24 hours after the patch release.
How widespread PHP is
More than half of the websites covered by SecuSeek Radar (59%) run PHP and remain exposed until they are updated. About 30% of them reveal their PHP version in the HTTP header, and 46% of these run PHP 8.1 or older. The PHP project no longer provides updates for these versions, so their operators depend on backports from their distribution or on an upgrade to a supported branch.
The most popular domains
Among the 100,000 most popular domains, PHP is less common on the main website, with 14% in the top 1,000, 24% in the top 10,000 and 34% in the top 100,000 (Figure 1). The main website, however, shows only part of the picture. In our data, we find that including the subdomains an organization operates itself, such as support pages, forums, blogs or faculty websites, raises the share to 40% in the top 1,000 and 45% in the top 10,000. Large organizations are therefore exposed mainly through their subdomains, even when their landing page does not use PHP.
Figure 1 PHP among the most visited domains. Share of domains running PHP on their main website and share of outdated versions among sites that disclose their version. Lines show the 95% confidence interval.
Differences by sector
The picture also differs by sector (Figure 2). In the top 10,000, 45% of university and school websites and 38% of websites of government bodies and political organizations run PHP. Among online shops (6%) and travel portals (5%), PHP on the main website is rare. Government websites also tend to run old installations, as 57% of those worldwide that disclose their version use PHP 8.1 or older.
Figure 2 PHP share by sector. Share of domains running PHP on their main website by IAB sector among the 10,000 most popular domains.
Differences by country
The share also varies between countries (Figure 3). Websites popular in Czechia and Italy run PHP most often (55% each), while the share is lower in the United States (38%) and lowest in China (22%). The age of the installations follows a different pattern. Among sites that disclose their version, 75% in South Korea, 68% in Russia and 66% in China run an unsupported PHP version, compared with 34% in India and 36% in Germany.
Figure 3 PHP use by country. Share of websites running PHP (a) and share of unsupported PHP versions among websites that disclose their version (b), by the country of their audience.
Case study of critical sectors
The question is particularly relevant for organizations that must manage the risks to their IT systems under the NIS2 directive. SecuSeek maintains a catalogue of organizations that may fall within the scope of the NIS2 directive. For this report, we focus on those in Germany. Of the 22,407 organizations analysed, more than 14,000 run their website on PHP, which corresponds to 64%. This is clearly above the global value and above the value for all websites with a German audience on our platform (51%).
The share is highest in health care at 79%, followed by waste management at 71% and food and transport at 69% each (Figure 4). Public administration (42%) and banking (11%) are at the lower end. Of the websites that disclose their version, 30% run PHP 8.1 or older, and one in five still runs PHP 7 or PHP 5. In health care and waste management, almost 40% run an unsupported version. Among operators classified as critical infrastructure (KRITIS), 54% run PHP. Across the German federal states, the share varies only between 58% and 70%, so no regional pattern emerges.
Figure 4 NIS2-relevant organizations by sector. Share of organizations whose website runs PHP and share of outdated versions among websites that disclose their version.
Patch status in the first hours
SecuSeek measured how fast operators reacted on the websites of NIS2-relevant organizations that disclose their full PHP version, starting seven minutes after the patch release and repeatedly within the first 24 hours (Figure 5). On the supported versions 8.2 to 8.5, the share of patched websites rose from 8% to 66% within three hours and reached 89% within the first 24 hours. The hosting provider mattered more than the sector. Within three hours, 98% of the websites hosted by the German shared hosting providers Strato and IONOS were patched, compared with 51% of the websites hosted elsewhere, while patching speed barely differs between NIS2 sectors.
Websites running PHP 8.1 or older show a different picture. Of about 630 such websites, 85% still ran the same outdated version on the day after the patch release, although about a third of them are hosted by Strato and IONOS as well. No official update exists for these versions, and moving to a supported branch can require changes to the application. Without a backport from their distribution, these websites remain vulnerable.
Figure 5 Patch status of NIS2-relevant websites after the patch release. Share of websites running PHP 8.2 to 8.5 that show a patched version and share of websites running PHP 8.1 or older that moved to a patched version.
“Keeping software up to date is what makes a fast response possible when a critical flaw becomes public. With PHP2Shell, we saw current PHP versions patched within hours, while outdated ones remained unprotected.”
Dr. Nurullah Demir, Founder and CEO of SecuSeek GmbH
Going offline as an emergency measure
Some operators chose to take their websites offline instead. The German Federal Office for Information Security (BSI) recommended considering a temporary disconnection from the internet if patches could not be applied immediately and reported operators that disconnected systems as a precaution [6]. Between about three and four hours after the patch release, the PHP websites of 1,339 NIS2-relevant organizations were no longer reachable, although they had been online shortly after the patch release. This corresponds to 11% of PHP websites, compared with 2% of websites without PHP in the same period. About half of the websites that became unreachable are hosted by the German provider Mittwald. Eight hours after the patch release, 74% of these websites were reachable again (Figure 6).
Figure 6 NIS2-relevant websites unreachable three to four hours after the patch release. Share of websites with and without PHP that were online shortly after the patch release.
Legacy versions for years
The large number of sites on unsupported versions is not a new problem (Figure 7). Since 2020, the share among sites that disclose their version has never fallen below 46%. After support for PHP 7.4 ended in November 2022, 91% ran an unsupported branch in early 2023. Each end of support thus leaves a large number of installations that receive no official patch for years when a vulnerability such as PHP2Shell appears.
Figure 7 Share of outdated PHP versions since 2020. Share of websites that disclose their PHP version and whose branch no longer received support at the time.
Recommendations for operators
The most important step is the update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or to the corresponding package of the distribution, followed by a restart of all PHP workers [1]. Where this is not immediately possible, the PHP project describes interim measures such as session.upload_progress.enabled=0 and a low limit for post_max_size, which only close the known attack paths [1]. Organizations should also check where PHP runs beyond their main website, for example on subdomains, at service providers and on legacy systems. Among the 10,000 most popular domains, we found almost 30 times as many outdated PHP installations on subdomains as on main websites.
Methodology
The analysis is based on SecuSeek Radar, our threat intelligence platform [7], and its external view of publicly reachable websites. Popularity in this report follows the Tranco list (ID 262W9) [2], the country comparison the Chrome UX Report [3], and sectors the IAB taxonomy [4] and, for the case study, the sectors of the NIS2 directive [5].
References
[1] The PHP Group. Security release of PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, 21 October 2026. https://www.php.net/ and GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp, https://github.com/php/php-src/security/advisories
[2] V. Le Pochat, T. Van Goethem, S. Tajalizadehkhoob, M. Korczyński, W. Joosen. Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation. Network and Distributed System Security Symposium (NDSS), 2019. https://tranco-list.eu/list/262W9
[3] Google. Chrome UX Report. https://developer.chrome.com/docs/crux
[4] IAB Tech Lab. Content Taxonomy. https://iabtechlab.com/standards/content-taxonomy/
[5] Directive (EU) 2022/2555 (NIS2 Directive), Annexes I and II. https://eur-lex.europa.eu/eli/dir/2022/2555/oj
[6] Federal Office for Information Security (BSI). PHP: Kritische Schwachstellen bedrohen Webanwendungen weltweit, BSI-IT-Sicherheitshinweis BITS-H 2026-297981-1132, version 1.1, 21 October 2026. https://www.bsi.bund.de/SharedDocs/Cybersicherheitswarnungen/DE/2026/2026-297981-1032.pdf
[7] SecuSeek Threat Intelligence Platform. https://radar.secuseek.com
← All reports