php2shell × Common Crawl by SwordSec

How much of the web reported a PHP version affected by php2shell?

php2shell (CVE-2026-109618, CVE-2026-109619) is a critical remote code execution flaw in PHP. We read the HTTP headers of every page in Common Crawl's October 2026 crawl and counted the websites that disclosed an affected PHP version.

Hosts potentially affected (self-reported version)

6.87M of 18.58M hosts with PHP evidence (37.0%)

Hosts crawled

41.5M

41,495,022 hostnames

Hosts with PHP evidence

18.58M

44.8% of crawled hosts

Domains with a potentially affected host

6.09M

17.5% of 34.83M registered domains

PHP, version not disclosed

11.7M

63.0% of PHP hosts: status unknown

The unknown box is the largest. 63.0% of hosts that run PHP did not say which version. Many of them are likely affected too, so 6.87M is a lower bound, not a total. PHP sites behind Cloudflare disclose their version about half as often as sites without a CDN (see the breakdown).

Half of them have no fixed release to install

50.9% of the hosts that disclosed an affected version run PHP 8.1 or older. Those branches are end of life: PHP published fixed releases only for 8.2, 8.3, 8.4 and 8.5.

Hosts by reported PHP branch
  1. ≤ 5.5 EOL389K · 5.7%
  2. 5.6 EOL345K · 5.0%
  3. 7.0 EOL92K · 1.3%
  4. 7.1 EOL73K · 1.1%
  5. 7.2 EOL174K · 2.5%
  6. 7.3 EOL219K · 3.2%
  7. 7.4 EOL1.27M · 18.5%
  8. 8.0 EOL300K · 4.4%
  9. 8.1 EOL634K · 9.2%
  10. 8.21.17M · 17.1%
  11. 8.31.33M · 19.4%
  12. 8.4616K · 9.0%
  13. 8.5254K · 3.7%
  14. 8.6 pre-release36 · <0.1%

Hover a bar for exact counts. Full table on the versions page.

Domains

6.09M registered domains (17.5% of 34.83M in the crawl) had at least one host that disclosed an affected PHP version. A domain counts once, however many of its hosts were crawled.

Check a domain

Shows what Common Crawl saw for that exact site between 2026-10-05 and 2026-10-18. Lookups are not logged.

What to do

If you run PHP 8.2 to 8.5

Update to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 (released 21 October 2026) or later. If your PHP comes from a Linux distribution, install its security update: distributions often backport fixes without changing the version number.

If you run PHP 8.1 or older

There is no official fixed release. Move to a supported branch, or take the site offline. The PHP project published source-level patches for 7.4, 8.0 and 8.1 only. Request-size limits and a WAF reduce the risk but do not remove it.

Read the PHP security advisory for details.