🇫🇷 French, 1 November 2026, PHP vulnerability
Over 30 million web services still vulnerable to PHP2Shell flaws
Despite patches being available for over 10 days, nearly 30 million PHP services remain exposed to the PHP2Shell vulnerabilities.
According to Censys, 29.6 million PHP services exposed on the internet were still running on a vulnerable version on October 30, 2026. The PHP2Shell flaws have been exploited in real-world attacks, including a recent incident where Chinese attackers took control of 25 servers in the US, Japan, Taiwan, and South Korea. The attackers combined PHP2Shell with a Linux kernel vulnerability to achieve their goal.
The PHP Foundation has released patches for PHP 7.4, 8.0, and 8.1, but users must apply them manually. The most common version of PHP on the internet is PHP 7.4.33, a version that is no longer supported. The CERT-FR has warned that users should migrate to a recent version of PHP as soon as possible.
Censys is tracking the PHP2Shell exposure and remediation worldwide, with a live dashboard that tracks affected PHP versions and patching progress by country, network, and PHP version.