The firm identified 1,990,772 hosts in the affected version range through Shodan and counted 127,430 on fixed releases; 1,863,342 remained unpatched.
The PHP Project shipped emergency releases on October 21 for CVE-2026-109618 and CVE-2026-109619, which OX describes as critical flaws enabling unauthenticated remote code execution in the PHP engine. In OX's first scan that evening, 245 of 1,991,515 classified affected hosts were on fixed versions. Its October 26 scan found 2,226,122 PHP instances overall.
OX also estimates that about 1.33 million affected hosts run end-of-life PHP 8.1 or older, which no longer receive official fixes. Its measured WordPress, Drupal, phpMyAdmin, Joomla, Laravel, Magento, and cPanel segments had not patched a quarter of affected hosts. The figures do not establish total internet exposure or patching rates for hosts that conceal their PHP version: OX excluded those hosts from its affected-versus-patched calculations and relied on publicly advertised versions in Shodan.