Patch Adoption Remains Low One Week After PHP2Shell Fix
Only 47.5% of live sites on supported PHP versions applied the latest patches, while older, unsupported versions show near-zero update activity.
PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 shipped on October 21 following the PHP2Shell fix. IPinfo re-checked 1.46 million addresses exposing a PHP version starting October 22. In an earlier October 14–15 scan of 1,105,160 addresses, 37% (409,494) ran versions 5.4 to 7.3, which are affected and receive no free official fix.
One week after the fix, about half of live sites running PHP 8.2 to 8.5 showed a patched release, with 47.5% (41,707 of 87,865) updated by October 28. Nearly all movement happened on the first day, when 36.5% of unpatched sites moved to a patched release. Default pages, panels, and devices on those branches were slower at 23.0%. Meanwhile, older branches barely moved, as only 0.95% (1,249) of 131,024 live sites on versions 5.4 to 7.3 reached a patched release. Wiz reported 5.7% for its customers' cloud machines.
IPinfo counted a server as patched if its version string showed 8.2.35, 8.3.36, 8.4.27, 8.5.12, or later, using the lowest version seen per address and excluding control-panel ports and mass-response blocks. October 26 was dropped because a large host hid PHP versions. Figures are minimums because some distributions, GoDaddy, and cPanel's EasyApache packages backport fixes without changing version numbers, and TuxCare sells patched builds for PHP 5.x through 8.1. CISA added PHP2Shell to its known-exploited vulnerabilities list on October 26, though IPinfo cannot see who was attacked.