PHP2Shell: 24 hours in, 99.3% of Measurable PHP Instances Are Still Unpatched
Our summary
A day after PHP shipped urgent patches for two unauthenticated remote-code-execution flaws dubbed PHP2Shell — CVE-2026-109618 and CVE-2026-109619 — the vast majority of exposed servers remain vulnerable. OX Security scanned Shodan and found over 2.2 million publicly visible PHP installations; among the roughly 1.97 million instances it could classify as running affected versions, only 14,151 had moved to a fixed release after 24 hours, meaning 99.3% stayed unpatched despite global warnings from governments and security agencies. The pace of remediation barely accelerated during the day, climbing from 245 patched hosts right after disclosure to 4,519 after twelve hours and 14,151 after a full day. Breaking the numbers down by popular PHP-based platforms such as WordPress, phpMyAdmin, Drupal, Laravel, Joomla, cPanel and Magento, OX Security found the same roughly 99% unpatched rate across the board, underscoring how slowly even critical fixes propagate to real-world production systems.
Below is the opening; the full story is at OX Security.
From OX Security
OX Security tracked over 2.2 million publicly exposed PHP instances following disclosure. Within 24 hours, only 14,151 affected systems visible on Shodan had been patched. The rate at which critical vulnerabilities are discovered continues to outpace our ability to remediate them at scale
Overview…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.