A live monitoring dashboard published by cybersecurity company Censys regarding the vulnerabilities dubbed PHP2Shell has revealed that older PHP versions are still widely used globally. According to data on the dashboard, the number of services identified as using affected PHP versions has reached 41 million 433 thousand 822 since the tracking process began on October 21. In recent scans, it was observed that 33 million 500 thousand 304 services are still running on an affected PHP version.
Censys determined that 7 million 943 thousand 892 services have switched to patched versions during the same period. Of these, 7 million 241 thousand 171 were seen with a patched version within the last 24 hours. However, the measurement used by the company does not directly show the number of servers or institutions; since multiple websites or services can exist on a single server, each service is evaluated as a separate record.
TURKEY DATA DRAWS ATTENTION
According to the country-based table, 364 thousand 237 PHP services in Turkey appear to be among the affected versions. This number corresponds to 92.9% of Turkey-based PHP services that disclose their version information. Turkey ranked 19th among 233 countries and regions in the ranking based on the number and rate of affected services.
However, this data does not mean that all websites or servers in Turkey are definitively vulnerable to attack. Censys's classification is based on the PHP versions reported in scans. Since some Linux distributions can apply security patches retroactively without changing the version number, some systems that are actually patched may appear in the affected version category.
SEVERITY OF VULNERABILITIES IS 9.2
PHP2Shell covers two critical vulnerabilities tracked under the codes CVE-2026-109618 and CVE-2026-109619. The vulnerabilities, stemming from errors in PHP's memory management, can allow attackers to execute remote code without authentication under appropriate conditions. For this reason, serious risks such as access to files and databases arise in affected systems. Both vulnerabilities were given a severity rating of 9.2 out of 10.
The vulnerabilities were identified with the contributions of Calif and Wiz researchers during work carried out as part of OpenAI's Patch the Planet initiative. Security researchers uncovered long-unnoticed issues in PHP by also utilizing AI-powered tools. While the vulnerabilities were announced to the public on October 21, 2026, the PHP team released new versions containing security patches on the same day.
Following the announcement, exploitation attempts also came to the fore. AWS reported that it detected an attempt from an anonymous IP address on a honeypot system on October 17, four days before the announcement. On the Cloudflare side, attack attempts that began before the announcement and accelerated afterward were also observed.
The PHP team released versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to close the vulnerabilities. Since no official security updates are provided for PHP 8.1 and older branches, systems using these versions need to be migrated to a supported PHP version.
News Source: 12punto
