# PHP patching tracker still counts around 29 million unpatched services

_Published Wednesday, November 4, 2026 at 8:42 AM EST · Security · Latest · Tier 2 — Notable_

![PHP website on a laptop — Primary](https://cdn.mos.cms.futurecdn.net/X86spL5fTiVTArGvMUbuZ5-1920-80.jpg)

Censys tracking cited by Tom's Hardware puts the number of unpatched PHP services at around 29 million, down from an initial estimate of around 45.7 million. The PHP2Shell exploit uses faulty cleanup after an out-of-memory error to execute code with PHP's permissions.

Maintained PHP branches have fixes, and vendors have also produced patches for older releases. Exploitation requires knowledge of the target's exact PHP version and build. The exposure count remains uncertain: backported fixes may leave version numbers unchanged, and 62% of PHP servers Censys consults do not report their version.

## Sources

- [Tom's Hardware](https://www.tomshardware.com/tech-industry/cyber-security/php-vulnerability-post-mortem-reveals-bug-was-known-two-years-ago-small-team-of-maintainers-knew-of-the-issue-before-it-was-made-public-as-new-php2shell-chained-exploit-ravages-servers)

---
Canonical: https://techandbusiness.org/newswire/eIXj-QhlPD6mFvrUGiCP_E
Published: 2026-11-04T13:42:02.444Z
Story chronology: 2026-11-04T12:30:00.000Z
Retrieved: 2026-11-04T21:55:54.794Z
Publisher: Tech & Business (techandbusiness.org)