Methodology

What we measured, how, and what the numbers cannot tell you.

Data

Common Crawl CC-MAIN-2026-43 collected about 2.2 billion web pages from 2026-10-05 to 2026-10-18. We processed its WAT metadata files (100,000 files, all of them): for every successfully fetched page (HTTP 200) they record the response headers and the server's IP address. Redirects and error pages are not part of WAT and are not counted. No site was contacted by us; this is passive data.

The crawl ended before the fixed PHP releases came out on 21 October 2026. These numbers are therefore a pre-patch baseline: every disclosed version of PHP was affected at the time. Later crawls will show patch progress.

Signals

Version: X-Powered-By: PHP/8.3.12 (the main signal) and, less often, a PHP token in the Server header such as Apache/2.4 (Debian) PHP/7.4.33.
PHP without a version: a PHPSESSID cookie, a PHP framework cookie (Laravel, CodeIgniter, PrestaShop, Bitrix, Drupal), a PHP CMS fingerprint (generator tag, X-Pingback, wp-json link, CMS-specific headers, same-site /wp-content/ assets) or a bare X-Powered-By: PHP.
CDN / WAF: recognised from response headers (Cloudflare, CloudFront, Fastly, Akamai, Sucuri, Imperva and others) and from the network of the server address.

We count hostnames (www.example.com and shop.example.com are two hosts) and roll them up to registered domains using the Public Suffix List.

Classification

Per GHSA-6wmf-4rv5-p3rp, versions below 8.2.35, 8.3.36, 8.4.27 and 8.5.12 are affected, with no lower bound.

Reported version	Result
8.2–8.5 below the fixed patch	Potentially affected
8.2–8.5 at or above the fixed patch	Fixed (none possible in this crawl: those versions did not exist yet)
Branch only, e.g. `PHP/8.3`	Potentially affected, low precision; never fixed
8.1 and older (8.0, 7.x, 5.x, 4.x)	Potentially affected, end of life
Major only (`PHP/8`) or impossible (`PHP/7.33`)	Unknown version

When a host's pages report different versions, X-Powered-By wins over Server, then the version seen on most pages. A host whose pages disagree about fixed versus affected is “conflicting”. Build suffixes such as -1ubuntu2.19 are ignored for the comparison. Distribution backports could not exist during this crawl, so no host is marked “backport possible”; from the November crawl on, they will be.

Denominators

Every rate names its base. The main ones:

Crawled hosts: 41,495,022.
Hosts with PHP evidence (broad): 18,577,177. A stricter base using only headers and the session cookie: 9,240,683.
Hosts with a usable version: 6,874,440 (37.0% of PHP hosts, 95% CI 36.98–37.03%).
Hosts with PHP but no usable version: 11,702,737 (62.97–63.02%).

Confidence intervals are 95% Wilson intervals. Cells with fewer than 10 hosts are shown as “<10”.

Limits

Self-reported. A header can be spoofed, stale or rewritten by a proxy. We never tested whether a site is exploitable.
Lower bound. 63.0% of PHP hosts disclose no version, and they hide it unevenly: behind a CDN far more often (see CDN breakdown).
Not a census. Common Crawl visits a sample of pages and favours well-linked sites; small or new sites may be missing. Hosts with one crawled page are 28.1% of the total.
CMS evidence is indirect. A WordPress fingerprint almost always means PHP, but static exports of PHP sites exist.
Location is the server's. IP geolocation (DB-IP Lite) says where the server is, not who owns the site, and is meaningless for CDN addresses, which we exclude from country figures.
Backports. Distribution packages may be fixed without a version change. This matters for later crawls, not this one.

Privacy and responsible use

We store hostnames, counts, versions and labels only: no URL paths, query strings or cookie values. We do not publish lists of sites; verified CERTs, hosting providers and security teams can request the data. The lookup answers for one site at a time, is rate limited, and is not logged; for a domain it gives counts but never names other hosts under it. We count page views with Google Analytics, which receives the page path only, never the domain you look up.

Other sources

This site complements, and does not replace, service-based scanners and threat feeds:

Censys php2shell exposure tracker: internet-wide, IP and service based, with patch progress.
Delft Intellab: observed exploitation activity.
NCSC-NL php2shell: operational guidance and product lists.

Reproducibility

Statistics generated 2026-10-29T10:29:50Z · pipeline commit ea0e494 · Public Suffix List from x/net v0.62.0 · geolocation dbip-country-lite-2026-10.mmdb, dbip-asn-lite-2026-10.mmdb.

Found an error? Write to info [at] swordsec [dot] com.