PHP2Shell, Day 5: The Panic Hasn’t Turned Into Patching

OX Security's ongoing scan of PHP2Shell patching shows remediation is barely moving. Five days after the PHP project rushed out fixes for CVE-2026-109618 and CVE-2026-109619 - two critical unauthenticated remote code execution flaws in the PHP engine - 93.6% of measurable PHP instances found via Shodan are still running vulnerable versions, down only slightly from 99.3% unpatched at the 24-hour mark. Of roughly 1.99 million affected hosts tracked since October 21, only about 127,000 have moved to a fixed release by October 26, and no measured software stack (including WordPress, Drupal, phpMyAdmin, cPanel, Joomla, Laravel, and Magento) has patched even a quarter of its exposed hosts. Making matters worse, about 1.33 million exposed hosts run end-of-life PHP branches that no longer get official patches, meaning many organizations must also upgrade their PHP version to actually close the hole. With public exploitation now confirmed rather than theoretical, this sluggish patch rate leaves a massive attack surface open to opportunistic attackers.