ⓘ magnific.com
PHP2Shell fixes skip older branches. See how many servers run PHP versions with no official patch, which backports exist, and what admins need to do about it soon.
The PHP2Shell fixes cover only PHP 8.2 to 8.5, which leaves a large share of internet-facing PHP hosts on versions that never got an official release. A Shodan count published by Mallory on October 20 found about 884,000 internet-facing hosts advertising an unsupported PHP version, or 59% of the roughly 1.5 million hosts that reveal one.
How big the gap is
Those figures are banner counts of hosts, not confirmed vulnerable sites, and about 740,000 more hosts hide their version. CybelAngel's breakdown of that data puts PHP 5.x at around 369,000 hosts, PHP 7.x at 329,000, and PHP 8.0 and 8.1 at 186,000, against 612,000 on 8.2 to 8.5, branches that now have fixes but were unpatched when counted. Shared hosting puts many sites behind one address, so the number of affected sites could differ. Palo Alto Networks separately counted more than 22.6 million potentially vulnerable instances.
What PHP did for old branches
PHP released no numbered versions for end-of-life branches. It did publish minimal source backports for 7.4, 8.0, and 8.1, aimed at people who compile PHP themselves. PHP published nothing for 5.6 or 7.3 and older. PHP 8.1 reached end of life on December 31, 2025; 8.0 in November 2023; and 7.4 in November 2022.
Why the version number can mislead
Linux distributions can ship the fix under the old version string. Ubuntu 22.04 patches its PHP 8.1 package through the normal security channel, while 7.4 on Ubuntu 20.04 needs Ubuntu Pro. A host reporting an old version may therefore be safe, and one reporting upstream 8.1.34 may not be. Admins should check vendor changelogs for both CVE IDs.
What admins should do
CISA advised organizations that cannot update, or that still run unsupported PHP 8.1 or earlier, to take PHP-based systems offline until they are patched or upgraded. The lasting fix is a supported branch, and 8.4 or 8.5 are the better targets because 8.2 security support ends on December 31, 2026. Forrester's Madelein van der Hout warned that checking only a main website misses suppliers and related apps and that patching does not remove an attacker who is already inside.