PHP Vulnerability Statistics 2026 | PHP2Shell, Critical CVEs, Affected Versions & Security Fixes

PHP vulnerability risk in 2026 centers on PHP2Shell: two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619. Each reportedly scores 9.2 on CVSS v4.0. The supplied research says the flaws affect PHP 5 and newer and were fixed on October 21, 2026, in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP runs 69.2% of websites with a known server-side language, while Shodan banner data reportedly shows that 59% of versioned internet-facing PHP hosts run branches with no official fix.

PHP Vulnerability 2026 — Introduction

The PHP vulnerability story of 2026 changed on October 20, when details of two unpatched flaws reportedly leaked online. Researchers named the pair PHP2Shell. Both flaws are described as allowing attackers to execute code on a web server without logging in.

PHP runs 69.2% of websites with a known server-side language, so a vulnerability in the core runtime can affect WordPress, Drupal, Magento, Laravel, and custom applications. Patches reportedly arrived on October 21, following reports of earlier attack attempts.

This report brings together the available figures on the two critical CVEs, patched versions, unsupported branches, exposed servers, reported attacks, and government responses. Each figure should be read alongside its source, particularly where different researchers use different methods to estimate exposure.

Interesting Facts About PHP Vulnerability 2026

PHP vulnerability statistics (2026)

Plugin share of 2025 WordPress flaws     ███████████████████████████████  91%

PHP share of known-language websites     ███████████████████████     69.2%

PHP 8 share of PHP websites              █████████████████████       65.5%

Versioned PHP hosts with no official fix ██████████████████          59%

Sources: W3Techs (October 26, 2026); PHP Project security advisories; Amazon Threat Intelligence; Shodan banner data published by Mallory and reported by CybelAngel; Patchstack, State of WordPress Security in 2026.

PHP accounts for 69.2% of websites with a known server-side language, and 65.5% of PHP sites reportedly run PHP 8. The two PHP2Shell flaws each score 9.2 on CVSS v4.0, within the critical severity band. Amazon reportedly recorded the first attack attempt four days before the patch was released.

The 59% figure comes from Shodan banner data and concerns hosts that reveal their PHP version. The 91% figure describes the share of WordPress ecosystem vulnerabilities attributed to plugins. These statistics use different denominators and should not be compared as if they measured the same population.

PHP Usage Statistics 2026: What Percentage of Websites Use PHP?

PHP share of websites with a known server-side language

Oct 18, 2025 | █████████████████████████████████████ 73.2%
Feb 10, 2026 | ████████████████████████████████████  72.2%
Jun 29, 2026 | ███████████████████████████████████   70.8%
Aug 04, 2026 | ███████████████████████████████████   70.5%
Sep 08, 2026 | ███████████████████████████████████   70.2%
Oct 26, 2026 | ██████████████████████████████████    69.2%

Source: W3Techs, “Usage Statistics of PHP for Websites,” snapshots dated October 2025 through October 2026.

PHP accounted for 73.2% of websites with a known server-side language on October 18, 2025. Its share fell to 72.2% on February 10, 2026, then to 70.8% on June 29, 70.5% on August 4, and 70.2% on September 8. The October 26 reading is 69.2%, a decline of 4.0 percentage points over roughly a year.

The decline appears to have accelerated late in the period. The share dropped by 1.0 percentage point between September 8 and October 26. PHP nevertheless remains widely used. A falling market share does not eliminate exposure on existing installations; systems still need to run a fixed, supported version.

PHP2Shell CVE-2026-109618 and CVE-2026-109619: Critical PHP Vulnerability Scores in 2026

Severity and exploit-likelihood scores (scale: 0–10)

CVE-2026-109618 — CVSS v4.0    █████████████████████████████████████  9.2

CVE-2026-109619 — CVSS v4.0    █████████████████████████████████████  9.2

CVE-2026-109618 — Bitsight DVE ████████████████████████████████████████  9.91

CVE-2026-109619 — Bitsight DVE ███████████████████████████████████████   9.84

Sources: PHP Project security advisories; Bitsight Threat Intelligence; Canadian Centre for Cyber Security, Alert AL26-026; National Vulnerability Database.

CVE-2026-109618 is described as memory corruption associated with an out-of-memory condition while PHP processes a request. CVE-2026-109619 is described as a use-after-free involving stale global state. Both reportedly score 9.2 on CVSS v4.0 and do not require authentication.

The Dutch National Cyber Security Centre reportedly warned that a single POST request may be sufficient to trigger an issue. Bitsight reportedly assigned exploit-likelihood scores of 9.91 and 9.84 out of 10 over the next 90 days. These scores are separate from CVSS severity ratings and should not be interpreted as probabilities.

A third issue, CVE-2026-115560, reportedly appeared on October 23. PHP classified its advisory as informational and described a configuration-dependent risk involving a session handler changed at runtime while upload progress remains enabled. The advisory reportedly does not bypass the October 21 fixes. Check the official PHP advisory and configuration guidance before making changes.

PHP2Shell Timeline 2026: Leak, Patch, and First Attacks

Reported milestones by date

October 17 | █       1 milestone
October 20 | ███     3 milestones
October 21 | ████    4 milestones
October 23 | ██      2 milestones
October 26 | █       1 milestone

Sources: Amazon Threat Intelligence; CERT-EU; CISA; Canadian Centre for Cyber Security; National Vulnerability Database; SecurityWeek.

According to the supplied timeline, October 21 had the most milestones, with four. October 20 had three, including the reported leak, PHP’s advance notice, and the CERT-EU advisory. The patch release was reportedly moved forward from October 22 to October 21.

The timeline suggests the first attack attempt preceded the patch by four days, while the advance notice came about one day before release. The KEV catalog status can change, so check CISA’s current catalog rather than relying on a dated snapshot.

Which PHP Versions Are Affected by PHP2Shell in 2026? Patched Branches and Support End Dates

Share of PHP 8 websites

PHP 8.3 | █████████████████  34.9%
PHP 8.2 | ██████████████     27.4%
PHP 8.1 | ███████            14.9%
PHP 8.4 | ██████             12.2%
PHP 8.0 | ███                 5.7%
PHP 8.5 | ██                  4.8%

Sources: W3Techs (October 26, 2026); PHP Project supported-versions timetable.

PHP 8.3 reportedly leads with 34.9% of PHP 8 sites, followed by PHP 8.2 at 27.4%. PHP 8.1 accounts for 14.9%, PHP 8.4 for 12.2%, PHP 8.0 for 5.7%, and PHP 8.5 for 4.8%.

According to these figures, branches 8.2 through 8.5 account for 79.3% of PHP 8 sites. Branches 8.0 and 8.1 account for 20.6% combined. PHP 8.2’s listed security-support end date is December 31, 2026, so administrators should plan a supported-version upgrade.

The supplied figures put PHP 8 at 65.5% of PHP sites, PHP 7 at 26.7%, PHP 5 at 7.7%, and PHP 4 at 0.1%. Using these rounded shares, approximately 51.9% of all PHP sites would run branches with a listed fix, while 48.1% would not. Treat this as an estimate, not a direct measurement.

The supplied material also says minimal source backports were published for PHP 7.4, 8.0, and 8.1 for teams that compile their own builds. Verify availability and applicability with the official advisory.

How Many PHP Servers Are Exposed to PHP2Shell in 2026? US and Global Host Counts

Internet-facing PHP hosts (each █ ≈ 50,000 hosts)

All PHP hosts in Shodan banners    | ███████████████████████████  2,240,000
Hosts hiding PHP version           | ███████████████              740,000
Hosts on PHP 8.2–8.5               | ████████████                 612,269
Hosts on PHP 5.6 and 7.2           | ███████                      371,000
PHP hosts at Amazon                | ██████                       293,480
US hosts with no official fix      | █████                                          228,770

Source: Shodan banner counts reportedly published by Mallory on October 20, 2026, and reported by CybelAngel.

The supplied Shodan data lists 2,240,000 internet-facing PHP hosts. It estimates that 59% of version-disclosing hosts run branches without an official fix. The listed count for PHP 5.6 and 7.2 is approximately 371,000. Another 740,000 hosts reportedly do not disclose their PHP version, limiting exposure estimates.

These are host counts, not website counts; one shared host or IP address may serve many websites.

The United States is listed with 228,770 hosts lacking an official fix, ahead of China, Japan, and Germany. The same data attributes 293,480 PHP hosts to Amazon, 142,401 to Hostinger, and 81,078 to Alibaba Cloud.

Other estimates reportedly differ. Censys identifies more than 13 million potentially affected internet-facing assets, SOCRadar tracks 5.1 million exposed hosts, and researcher Silas Cutler estimates 1.3 million potentially vulnerable hosts. These figures should not be combined because their definitions and methods may differ.

PHP2Shell Exploitation Statistics 2026: Attacks Before and After the Patch

Days relative to the reported patch date: October 21, 2026

Before patch                  Patch day                  After patch
October 17                    October 21                 October 26
████  −4 days                 ●  0 days                  █████  +5 days

Amazon attempt           watchTowr / Cloudflare          CISA KEV check

Sources: Amazon Threat Intelligence; watchTowr; Cloudflare; CISA Known Exploited Vulnerabilities catalog; SecurityWeek.

Amazon reportedly logged the first attempt on October 17, four days before the patch date. watchTowr and Cloudflare reported activity on October 21, the patch date. A CISA catalog check on October 26 reportedly found neither CVE in the KEV catalog.

Vendor telemetry and agency observations may differ because they reflect different sources, collection methods, and definitions of exploitation.

The supplied material also describes a researcher observing shell commands on a honeypot and notes that results from a single-worker mod_php setup may not generalize to other configurations. Hadrian reportedly observed attacks at scale, particularly through the session upload-progress path. Cloudflare described firewall rules as a temporary measure.

Administrators should prioritize patching and investigate suspicious PHP worker processes.

PHP2Shell Government Response 2026: CISA, CERT-EU, and Canada Cyber Centre Actions

Days after the first reported attack attempt (October 17)

CERT-EU advisory, October 20          | ███     3 days
CISA alert, October 21                | ████    4 days
Canada Cyber Centre alert, October 21 | ████    4 days
CISA alert update, October 23         | ██████  6 days

Sources: CERT-EU Security Advisory 2026-018; CISA PHP2Shell alert; Canadian Centre for Cyber Security, Alert AL26-026.

The supplied timeline places CERT-EU’s advisory three days after the first reported attempt. CISA and the Canadian Centre for Cyber Security followed on day four. CISA reportedly added a Sigma rule on day six to help defenders identify PHP workers spawning suspicious child processes.

The source material also says Germany’s BSI recommended disconnecting vulnerable servers if patching was delayed, and Colombia’s ColCERT counted 8,699 exposed PHP services.

Disabling session.upload_progress.enabled may block one demonstrated path for CVE-2026-109619, but it is not a complete fix for both vulnerabilities. Web application firewall rules may provide temporary protection against known attack patterns. Apply the vendor’s official guidance and patch the PHP runtime.

WordPress PHP Vulnerability Statistics 2026: Plugin Flaws Drive 91% of New Issues

WordPress ecosystem vulnerabilities
2024 total                    ████████████████████████  7,966
2025 total                    █████████████████████████████████  11,334
2025 plugin flaws (estimated) ███████████████████████████████  ~10,314
2025 theme flaws (estimated)  ████  ~1,020

Source: Patchstack, State of WordPress Security in 2026.

Patchstack reportedly counted 7,966 new WordPress ecosystem vulnerabilities in 2024 and 11,334 in 2025, an increase of 42%. Plugins accounted for 91% of the 2025 total and themes for 9%. Applying those rounded shares gives approximately 10,314 plugin vulnerabilities and 1,020 theme vulnerabilities.

WordPress plugins execute PHP code, but a plugin flaw and a PHP runtime flaw are different issues. PHP2Shell reportedly affects the runtime itself, below WordPress core and plugins.

Updating WordPress or its plugins does not patch the PHP installation. Site owners should update the server-side PHP runtime and continue maintaining WordPress core, themes, and plugins.

PHP Vulnerability FAQ 2026

What Is the PHP Vulnerability in 2026?

PHP2Shell is the name given to two reported critical flaws, CVE-2026-109618 and CVE-2026-109619, which are described as allowing unauthenticated remote code execution. Each is reported with a CVSS v4.0 score of 9.2. The supplied timeline says PHP released fixes on October 21, 2026.

What Is PHP2Shell in 2026?

PHP2Shell refers to the reported pair of PHP flaws and a leaked exploit tool. The issues are described as involving request handling and memory, potentially allowing an attack before application-level code runs.

Which PHP Versions Are Vulnerable to PHP2Shell in 2026?

The supplied research says PHP 5 and newer are affected. It identifies Apache mod_php as a particularly exposed configuration and also discusses PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed. Confirm affected configurations against the official PHP advisory.

Which PHP Versions Fix PHP2Shell in 2026?

The supplied patch versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. After upgrading, confirm the version used by the actual web server and its workers; the command-line PHP version may differ from the web-facing runtime.

Is PHP 8.1 Patched for PHP2Shell in 2026?

The supplied material says PHP 8.1 is end of life and has no standard official release for this issue. It also mentions minimal source backports for teams compiling their own builds. Verify availability and applicability with the official advisory, and plan to move to a supported branch.

Is PHP2Shell Being Exploited in the Wild in 2026?

The supplied sources report attack activity. Amazon reportedly saw an attempt on October 17, while watchTowr and Cloudflare reported activity on October 21. The material also says CISA reported on October 21 that it had not observed exploitation. These observations may reflect different telemetry and definitions.

Is PHP2Shell in the CISA KEV Catalog in 2026?

The supplied article says neither CVE appeared in the catalog during a morning check on October 26, 2026. KEV status can change, so check CISA’s current Known Exploited Vulnerabilities catalog for the latest status.

How Do I Check My PHP Version for the 2026 PHP Vulnerability?

Run php -v on the server, and separately verify the version used by the web server through your hosting control panel or provider. Compare the installed runtime with the fixed release for its branch. On shared hosting, ask the provider to confirm the web-facing version and patch status.

Can I Mitigate PHP2Shell Without Updating PHP in 2026?

Only partially. The supplied guidance says disabling session upload progress may block one path for CVE-2026-109619, while a web application firewall may block known attack patterns. Neither measure replaces installing a fixed PHP release.

Does Updating WordPress Fix the PHP Vulnerability in 2026?

No. The reported PHP2Shell flaws are in the PHP runtime, not WordPress core or its plugins. Update PHP at the server level, then keep WordPress core, themes, and plugins current to address their separate vulnerabilities.

How Many Websites Use PHP in 2026?

The supplied W3Techs figure is 69.2% of websites with a known server-side language as of October 26, 2026. The article lists the share as 73.2% in October 2025.

What Is CVE-2026-115560 in 2026?

The supplied material describes CVE-2026-115560 as a separate, configuration-dependent issue involving session upload progress and a session handler changed at runtime. It says PHP published an informational advisory on October 23, 2026. Check the official advisory for affected configurations and recommended settings.

What Should US Organizations Do About the 2026 PHP Vulnerability?

Inventory PHP installations, prioritize internet-facing servers, install the vendor’s fixed release, and follow current CISA guidance. Where patching is not immediately possible, apply the vendor’s temporary mitigations, restrict exposure where feasible, and investigate suspicious PHP worker processes. Do not treat a mitigation as a substitute for patching.

Disclaimer: This research report is compiled from publicly available sources. While reasonable efforts have been made to ensure accuracy, no representation or warranty, express or implied, is given as to the completeness or reliability of the information. We accept no liability for any errors, omissions, losses, or damages of any kind arising from the use of this report.