Original data · from real checks
PHP2Shell patch status: how many websites are still unpatched?
Totals from 5666 website checks run with our free checker since 2026-10-21. Each site counts once, using its latest check. Data as of 2026-10-23 04:53 UTC.
Last reviewed 2026-10-23
456 sites
revealed an exact PHP version, out of 4522 sites checked.
194 fixed (43%)
Report 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer on their branch.
106 not updated (23%)
On a supported branch (8.2–8.5) but below the fixed release.
156 end-of-life (34%)
On PHP 8.1 or older, which gets no official release.
How this compares with internet-wide scans
An internet-wide tracker put the patched share of all visible PHP hosts at 6.96% on 2026-10-23 (PHP2Shell tracker), and Censys publishes hourly scan data. Our patched share is higher because people check sites they look after, and some check again after patching. Both point the same way: most PHP that shows its version is still unpatched.
Patch rate by PHP branch
Sites that revealed an exact version, grouped by branch.
| Branch | Sites | Fixed | Not updated | Fixed share |
|---|---|---|---|---|
| 8.5 | 85 | 45 | 40 | 53% |
| 8.4 | 55 | 46 | 9 | 84% |
| 8.3 | 97 | 64 | 33 | 66% |
| 8.2 | 63 | 39 | 24 | 62% |
| 8.1 and older | 156 | 0 | 156 | 0% |
Most common end-of-life branches: 7.4 (58), 8.1 (25), 8.0 (13). These get no official PHP release; see older PHP for options.
What the checks could see
Most sites do not reveal their PHP version, so the figures above cover a small, visible part of all checks.
| Result | Sites | Share |
|---|---|---|
| PHP with a readable version | 456 | 10% |
| PHP, version hidden | 1,452 | 32% |
| Not PHP | 506 | 11% |
| Not enough signals | 1,178 | 26% |
| Unreachable or blocked the check | 930 | 21% |
By day
Distinct sites with a readable version checked each day (UTC), and how many of them were fixed.
| Day (UTC) | Sites | Fixed | Fixed share |
|---|---|---|---|
| 2026-10-21 | 5 | 2 | 40% |
| 2026-10-22 | 442 | 189 | 43% |
| 2026-10-23 | 27 | 4 | 15% |
Method and limits
- Source: checks run on this site with the free checker. Only totals are published; no checked address, host or visitor is listed.
- Each site (hostname, ignoring “www.”) counts once, using its most recent check. Invalid, private and self-referencing addresses are excluded.
- A version is readable only when the server exposes it, usually in the
X-Powered-Byheader. A vendor backport can fix an older-looking version, and a site can report a fixed version while old workers still run, so a single site’s result is a signal, not proof. - Self-selected sample: people check sites they run or worry about, after hearing of PHP2Shell. It is not a random sample of the web.
Questions
How many websites are still vulnerable to PHP2Shell?+
Of the 456 websites in our checks that reveal an exact PHP version, 57% (262) run a release without the fix: 106 on a supported branch that has not been updated and 156 on an end-of-life branch. Figures as of 2026-10-23 04:53 UTC.
Why is your patched share higher than internet-wide scans?+
Internet-wide scans count every visible PHP host, including abandoned ones; on 2026-10-23 one tracker put the patched share at 6.96%. Our figures come from sites people chose to check, sometimes after patching, so they lean towards fixed sites.
Which PHP branch has the lowest patch rate?+
Among supported branches, PHP 8.5: 53% of sites on it that reveal a version run the fixed release.
Is this a random sample of the internet?+
No. These are sites people chose to check, often their own or their clients’. Owners who already patched may check more often, and most sites hide their version. Treat the figures as a signal, not a census.
Check your own site
Related
- Website & version checkerCheck a website’s public PHP signals by URL, or paste a PHP version. Understand PHP2Shell patch status, limits and what to ask your hosting provider.
- Fix / patchFix PHP2Shell on Linux, Docker, cPanel, Plesk, macOS and Windows. Follow patch, restart and verification steps, including options for older PHP.
- TimelineFrom the 2024 audit to the 21 October 2026 release: every PHP2Shell disclosure step in UTC, the early leaks, the PHP Foundation’s response and who found what.