PHP Flaws Scored 9.2 Leak Online, Threatening 7 in 10 Websites

Q: With exploit details already leaked, how many legacy PHP servers are currently sitting ducks for remote code execution?

There is no verified global count yet, but the best public estimate points to roughly 884,000 internet-facing hosts running PHP 8.1 or older that are potentially “sitting ducks” because those branches are end-of-life and are not expected to receive upstream fixes. That figure comes from a security-company count of Shodan banners on Oct. 20, which found about 1.5 million internet-facing hosts reporting a PHP version, with 59% on 8.1 or below. It is only a rough exposure measure: banner data can be wrong, some systems may not be vulnerable in practice, and PHP had not yet published the final affected-version list when those counts circulated. Another roughly 740,000 hosts reportedly exposed PHP without revealing a version, leaving additional uncertainty. What is clearer is the risk pattern. PHP’s supported branches are 8.2 through 8.5. Versions 8.1, 8.0, 7.x and 5.x are already unsupported, and multiple responders said those older branches are unlikely to get official fixes even if the flaws affect them. Some reporting and researchers suggested the bugs may reach back as far as PHP 5.4 or even PHP 5 broadly, but PHP itself had not confirmed the exact scope before release. So the answer is not “millions of servers,” but potentially hundreds of thousands of legacy internet-facing PHP hosts, with the true number possibly higher once unversioned and bundled deployments are counted.

2 articles · Updated · Yahoo · Oct 21

Two critical PHP vulnerabilities — CVE-2026-109618 and CVE-2026-109619 — leaked Tuesday before a planned Wednesday 9 a.m. CT patch, exposing websites that rely on the language.
Security researchers said the flaws could let attackers remotely execute code on a server without prior access, potentially handing over control of affected sites.
WordPress, MediaWiki and many e-commerce platforms are in the blast radius because PHP underpins nearly 7 in 10 websites whose server-side language is known, according to W3Techs.
A video posted Tuesday appeared to show one exploit in use, and researchers said hackers were showcasing the bugs online, though there was no evidence of large-scale attacks by late Tuesday.
PHP security said it could release patches earlier if public details spread further or active exploitation emerges, underscoring how a core web component can create internet-wide risk.