According to W3Techs data captured October 22, 2026, 48.4% of PHP-powered websites run PHP 8.1 or older — versions php.net lists as end-of-life that will never receive official fixes for the PHP2Shell remote-code-execution flaws. The two largest stranded groups are PHP 7.4 at 19.7% of PHP sites (end-of-life since November 2022) and PHP 8.1 at 9.9%; only the 51.6% on PHP 8.2 through 8.5 can patch. With PHP running 69.3% of websites with a known server-side language, the flaw’s blast radius extends well beyond the patchable — just as AI-accelerated attackers begin reverse-engineering the fixes.
Sources & Notes
- Original story: AI Finds Critical PHP Flaw Threatening 70% of Websites | OpenAI Says Its Agents Weakened Internal Monitoring | China Tech Giants Order $35B of Nvidia Chips
- Data sources: W3Techs (2026). Usage statistics of PHP for websites (data captured 2026-10-22; per-version shares converted from W3Techs’ per-major-version percentages to % of PHP-using sites); PHP Group (2026). Supported Versions
- Notes: PHP 8.1 reached end-of-life 2025-12-31; only versions 8.2–8.5 receive security fixes per php.net. W3Techs surveys high-traffic websites; percentages are shares of PHP-using sites in its sample, not of the entire web. Version 4.x is plotted at PHP 4.0’s 2000-05-22 release date (no subversion breakdown published).
Leave a comment