---
type: "post"
id: "ox-security-93-6-of-measurable-php-hosts-e44b08"
slug: "ox-security-93-6-of-measurable-php-hosts-e44b08"
title: "OX Security: 93.6% of measurable PHP hosts still unpatched five days later"
description: "OX Security reported on October 26, 2026 that 93.6% of measurable PHP instances affected by PHP2Shell remained unpatched five days after emergency fixes shipped."
retrieval_nugget: "OX Security reported on October 26, 2026 that 93.6% of measurable PHP instances affected by PHP2Shell remained unpatched five days after emergency fixes shipped."
published_at: "2026-10-27"
updated_at: "2026-10-27"
record_date: "2026-10-27"
date_kind: "published_at"
topics: ["security"]
entities: ["OX Security","PHP","PHP2Shell","Shodan","WordPress","Drupal","phpMyAdmin"]
related_patterns: []
novelty_label: "new_fact"
what_changed: "OX Security reports that five days after the PHP2Shell fixes shipped, 93.6% of measurable PHP instances remained exposed."
prior_refs: ["memory:adbf0862-afe9-8378-a5ea-67a80aadd28d","memory:fc237a5b-bcd7-8048-a76c-1cbc810c9bab","memory:592c9dc4-991d-8a8c-ae31-be347a0f42d2"]
source_url: "https://www.ox.security/blog/php2shell-day-5-the-panic-hasnt-turned-into-patching"
source_urls: ["https://www.ox.security/blog/php2shell-day-5-the-panic-hasnt-turned-into-patching"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:ox-security-93-6-of-measurable-php-hosts-e44b08"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/ox-security-93-6-of-measurable-php-hosts-e44b08/","markdown":"https://newruntime.com/posts/ox-security-93-6-of-measurable-php-hosts-e44b08.md","json":"https://newruntime.com/posts/ox-security-93-6-of-measurable-php-hosts-e44b08.json"}
---

# OX Security: 93.6% of measurable PHP hosts still unpatched five days later

## Retrieval answer

OX Security reported on October 26, 2026 that 93.6% of measurable PHP instances affected by PHP2Shell remained unpatched five days after emergency fixes shipped.

OX Security reported on October 26, 2026 that 93.6% of measurable PHP instances affected by PHP2Shell remained unpatched five days after emergency fixes shipped. The firm identified 1,990,772 hosts in the affected version range through Shodan and counted 127,430 on fixed releases; 1,863,342 remained unpatched.

The PHP Project shipped emergency releases on October 21 for CVE-2026-109618 and CVE-2026-109619, which OX describes as critical flaws enabling unauthenticated remote code execution in the PHP engine. In OX's first scan that evening, 245 of 1,991,515 classified affected hosts were on fixed versions. Its October 26 scan found 2,226,122 PHP instances overall.

OX also estimates that about 1.33 million affected hosts run end-of-life PHP 8.1 or older, which no longer receive official fixes. Its measured WordPress, Drupal, phpMyAdmin, Joomla, Laravel, Magento, and cPanel segments had not patched a quarter of affected hosts. The figures do not establish total internet exposure or patching rates for hosts that conceal their PHP version: OX excluded those hosts from its affected-versus-patched calculations and relied on publicly advertised versions in Shodan.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Security](https://newruntime.com/topics/security.md): Explore the security topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)