GLOBAL – October 29, 2026 -- Only 14,151 of 1,974,890 measurable PHP instances in the affected version range showed a patched release 24 hours after PHP shipped emergency fixes for the PHP2Shell flaws, leaving 99.3% exposed, according to OX Security.
PHP released the fixes on October 21 for CVE-2026-109618 and CVE-2026-109619. Both are critical vulnerabilities that allow unauthenticated remote code execution in the PHP engine itself. Governments and security agencies urged organizations to patch immediately, and some organizations took systems offline.
Patched share reached just 0.72% of the affected population after 24 hours
OX Security queried Shodan over the 24 hours following disclosure and tracked more than 2.2 million publicly visible PHP instances. At the initial assessment, Shodan showed 2,224,364 instances. Of those with classifiable versions, 1,991,515 ran versions in the affected range, and 245 showed a newly patched release. Around 233,000 instances ran PHP 5.3 or older, which are not vulnerable to PHP2Shell.
Twelve hours later, 4,519 patched instances were visible. After 24 hours the count reached 14,151.
Roughly 99% of hosts on WordPress, Drupal, Laravel and other PHP platforms remained unpatched
The pattern held across PHP-based technologies including WordPress, phpMyAdmin, Drupal, Laravel, Joomla, cPanel and Magento. Among affected hosts whose PHP versions could be identified, roughly 99% were not showing a patched version after 24 hours. OX Security cautioned that the data covers only indexed hosts exposing enough version information and is not an estimate of the total vulnerable population for any single technology.
Methodology excludes hosts that hide their PHP version
OX Security identified PHP versions from publicly exposed information, including X-Powered-By headers. Hosts that do not expose their version were excluded from the affected-versus-patched calculations. Because Shodan is a continuously changing index, shifts in total indexed hosts should not be read as evidence of patching, isolation or systems going offline.
Operational friction outweighs deployment speed, OX Security says
OX Security notes that standard emergency playbooks call for patching and validation within an hour, and that deployment itself takes minutes. It attributes the gap to fear of breaking live production systems, complex dependencies and delayed approvals.
PHP2Shell also arrived while security teams were responding to other incidents, including the LiteLLM compromise. OX Security argues that AI is accelerating vulnerability research and exploit development, while organizations still have to identify affected systems, determine exposure, test updates and deploy fixes in production.
"We are getting faster at finding critical vulnerabilities than we are at removing them from the internet," OX Security said, adding that defenders will need to reduce unnecessary internet exposure, monitor for exploitation and prioritize the vulnerabilities carrying the greatest actual risk.