The PHP cybersecurity crisis continues, with 32.5 million servers remaining vulnerable. According to Censys data, over 10 million of them are in the US, and critical PHP vulnerabilities are being actively targeted by threat actors, the US Cybersecurity and Infrastructure Security Agency (CISA) has confirmed.

Nearly a week has passed since the initial disclosure of 2 critical PHP bugs, collectively known as PHP2Shell. Fresh Censys data has revealed a huge patch gap – 10s of millions of systems still run PHP versions susceptible to PHP2Shell.

Only about a quarter of PHP services revealing their versions – 11.2 million assets – have been updated to a fixed version. That leaves 32.5 million exposed PHP services still running on a vulnerable version.

Additionally, over 60 million PHP services do not report their versions, leaving the total number of vulnerable PHP services unclear.

The US alone hosts 10.3 million still-vulnerable PHP services, 3.2 million already-patched instances, and over 20 million other services with unknown PHP versions.

Germany is second, with over 4 million known vulnerable PHP services, followed by France with over 2 million.

Patching surged for just 2 days, with roughly 4.3 million PHP services upgraded on both October 22nd and 23rd, but then it fell off sharply. The cybersecurity platform constantly updates the figures in a PHP2Shell-dedicated dashboard.

Censys acknowledges that the data has limitations.

The data is presented as daily snapshots and can be delayed by hours. It also relies on self-reported versions, which are often inaccurate – Linux distributions often backport fixes without bumping the PHP version. And Censys reports service counts – one service might be running several PHP instances on different ports.

Exploitation in the wild confirmed

CISA has evidence that the bugs are actively exploited in the wild and has included them in its Known Exploited Vulnerabilities Catalog, as of October 26th, 2026. That’s nearly a week after the first exploitation attempts were reported by AWS.

Federal agencies have until October 29th to apply the mitigations.

The PHP Foundation released patches on October 21st, after sending advance notice to downstream maintainers a day prior. Dozens of vendors, including WordPress, AWS, Palo Alto Networks, and CISA itself, followed up with their advisories.

Amazon’s threat intelligence team reported that the earliest exploitation attempts predated public disclosure of the vulnerabilities. Its honeypots recorded exploitation attempts on October 17th, 4 days before the embargo was lifted. The attacker’s IP originated from a commercial anonymization network.

“It remains unclear how the actor acquired exploit information prior to disclosure,” the AWS Security Blog post reads.

Amazon detected multiple proof-of-concept exploits and cyberattack attempts on the release date, with varying payloads and anonymization infrastructure, suggesting multiple actors.

Palo Alto’s Unit 42 initially reported that a European government had been breached by leveraging PHP2Shell. However, the team later retracted the claim, saying it is unable to confirm that initial access is associated with the specific vulnerability.

One security researcher even set up a “Steal My Bitcoin” vulnerable website, challenging participants to crack it leveraging PHP bugs and claim the $2,000 prize – it fell in less than 24 hours.

Last week, CYFIRMA reported low-volume scanning campaigns targeting the global PHP infrastructure and suspected they originated from North Korea.

PHP is a widely used backend scripting language that powers 70% of all websites. Cybernews reported that 2 critical flaws were discovered in the PHP core engine – an interpreter that runs on web servers and generates HTML pages by executing server-side code. The discovery of the bugs prompted some websites, including Wikipedia, the Internet Archive, and government websites, to temporarily shut down their services.

Attackers, using specially crafted upload requests, can trigger memory errors, potentially leading to remote code execution without any privileges or logins.

The bugs, both rated 9.2 out of 10 on the severity scale, are tracked as CVE-2026-109618 and CVE-2026-109619.

Patching is not enough

CISA warns all organizations that PHP prevalence may often not be directly observable – it’s a common component of other software. Organizations must identify and inventory their systems running any version of PHP.

“The vulnerabilities affect all PHP installations serving web requests, including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities,” CISA’s advisory reads.

Many web servers remain running PHP versions 5.4 through 7.3, which are end-of-life and will never receive fixes – those hosts need to move to a supported branch, Censys warned.

Admins who left their servers vulnerable for the entire week should also check for potential compromise: review web server access logs, and inspect the PHP session storage directory for unexpected files.