NSA Says Patch PHP or Go Offline as AI-Found PHP2Shell Flaws Reach ~70% of the Web
How much of the web PHP2Shell touches
PHP2Shell reaches most of the web because it lives in PHP itself, not in any one app. Sansec reports the vulnerable code dates to PHP 5.4 in 2012 and default configurations are exposed, so the risk is the language's entire footprint.
Websites with a known server language that run PHP
Same measure, August 2026
70.2% (65.9% among the top 1 million sites)
Websites running PHP
about 24 million
BuiltWith, via Computer Weekly
Internet-exposed instances potentially vulnerable
more than 22.6 million
Exposed hosts by Shodan search
about 1.9 million
Exposed hosts, researcher estimate
more than 1.3 million
Version-visible servers on unsupported PHP 5.4–8.1
about 758,000
Version-visible servers on supported branches
about 272,000
The counts differ because they measure different things: sites versus servers, detectable versus all. The share figures cover only sites...
Copyright of this story solely belongs to hackernoon.com. To see the full text click HERE
