Global – October 29, 2026 -- Five days after the PHP project shipped emergency fixes for the PHP2Shell flaws, 93.6% of measurable PHP instances remain exposed, according to OX Security scans run through October 26, 2026. That is roughly 15 of every 16 hosts the firm can measure.
The PHP project released the fixes on October 21 for CVE-2026-109618 and CVE-2026-109619. Together, the two critical flaws let an unauthenticated attacker execute code remotely inside the PHP engine. Security agencies issued urgent advisories, and some organizations took systems offline while assessing their exposure.
Patch uptake rose from 245 hosts to 127,430 in five days
OX Security's first scan on the evening of October 21 found 2,224,364 PHP instances on Shodan. Of those, 1,991,515 fell in the affected version range, and only 245 already ran a fixed release. By October 26, 127,430 hosts had reached a fixed version. After 24 hours, 99.3% of measurable instances had been unpatched.
No segment OX Security measured has patched even a quarter of its affected hosts.
1.33 million hosts run end-of-life branches with no official fix
Approximately 1.33 million affected hosts run PHP branches that no longer receive official fixes. For these systems, remediation may require a full version upgrade.
Version-hiding hosts fall outside the figures
OX Security ran repeated Shodan queries from the first evening after disclosure through October 26 and classified each host by the PHP version it advertises publicly. Hosts that conceal their version cannot be classified and are excluded from every affected-versus-patched figure.
OX Security noted that exploits are now proven in the wild rather than theoretical. It also pointed to the "Steal My Bitcoin" challenge, which offered a crypto reward to anyone who successfully exploited a deliberately vulnerable PHP site, as a distraction from patching.