PHP2Shell Patch Gap Leaves Many Older PHP Servers Without Official Fixes
The PHP2Shell security updates have created a serious challenge for website owners, hosting providers, and system administrators. While fixes are now available for PHP 8.2 through PHP 8.5, a large portion of internet-facing PHP servers still run older versions that no longer receive full official support.
That gap matters because PHP remains one of the most widely used technologies behind websites, web apps, content management systems, ecommerce platforms, and custom business tools. When older PHP branches are left behind, millions of sites may depend on systems that are difficult to patch, expensive to upgrade, or hidden inside complex hosting environments.
A Shodan count published by Mallory on October 20 found around 884,000 internet-facing hosts advertising unsupported PHP versions. That represents about 59% of the roughly 1.5 million hosts that publicly reveal a PHP version. The actual picture is harder to measure because another 740,000 hosts do not disclose their PHP version at all.
The scan results do not prove that every listed host is vulnerable. They are banner counts, meaning they show what servers claim to be running, not whether a specific exploit works. Still, the numbers highlight a major PHP security risk: many public-facing systems appear to be running branches that are already past their end-of-life dates.
A breakdown of the visible data from CybelAngel shows how widespread older PHP versions remain. PHP 5.x accounts for roughly 369,000 hosts, while PHP 7.x appears on about 329,000 hosts. PHP 8.0 and PHP 8.1 together account for around 186,000 hosts. By comparison, about 612,000 hosts were seen running PHP 8.2 through PHP 8.5, the currently covered branches that now have fixes available.
The real number of affected websites may be very different from the number of affected hosts. In shared hosting environments, one server address can support hundreds or even thousands of individual sites. That means a single exposed host could represent many web properties, or in some cases only one. Palo Alto Networks has separately estimated more than 22.6 million potentially vulnerable instances, showing how broad the exposure could be across the internet.
PHP did not release new numbered versions for end-of-life branches. Instead, it published minimal source backports for PHP 7.4, PHP 8.0, and PHP 8.1. These backports are mainly useful for administrators and vendors who build PHP from source themselves. They are not the same as a normal official maintenance release that most users can simply install through standard update channels.
For even older branches, the situation is more limited. PHP published no backports for PHP 5.6, PHP 7.3, or earlier versions. That leaves organizations running very old PHP environments with few safe options beyond emergency vendor support, custom patching, isolation, or a full upgrade.
The timeline is important. PHP 7.4 reached end of life in November 2022. PHP 8.0 followed in November 2023. PHP 8.1 reached end of life on December 31, 2025. Once a branch reaches end of life, regular security maintenance stops, and critical fixes may not arrive in the form administrators expect.
However, version numbers can be misleading. Some Linux distributions backport security fixes while keeping the same visible version string. For example, Ubuntu 22.04 can patch its PHP 8.1 package through the normal security update channel, even though the displayed PHP version may still look old. Meanwhile, PHP 7.4 on Ubuntu 20.04 may require Ubuntu Pro to receive certain security fixes.
This creates a tricky situation for administrators. A server that reports an older PHP version may already be patched by its operating system vendor. At the same time, a server showing an upstream PHP 8.1.34 build may still be missing the necessary protection if it has not received the relevant fixes. The safest approach is to check vendor changelogs and package security notes for the related CVE entries rather than relying only on the PHP version number.
CISA has advised organizations that cannot update, or that still run unsupported PHP 8.1 or earlier, to take PHP-based systems offline until they are patched or upgraded. That guidance reflects the seriousness of the issue, especially for public-facing applications that handle logins, payments, customer data, internal dashboards, or administrative tools.
The long-term fix is to move to a supported PHP branch. PHP 8.4 or PHP 8.5 are better upgrade targets than PHP 8.2 because PHP 8.2 security support ends on December 31, 2026. Upgrading to a newer branch gives organizations more time before the next forced migration and reduces the risk of being caught on an unsupported platform again.
Security teams should also avoid checking only the main company website. Forrester analyst Madelein van der Hout warned that organizations often miss supplier portals, related applications, legacy tools, and third-party systems. Those forgotten assets can become easy entry points for attackers.
Patching is also not the same as removing an intruder. If an attacker already gained access before the fix was applied, updating PHP will not automatically clean the system. Administrators should review logs, check for suspicious files, rotate credentials, inspect web shells, and verify that no unauthorized accounts or persistence mechanisms remain.
The PHP2Shell response shows a familiar problem in web security: the most dangerous systems are often the oldest, least visible, and hardest to upgrade. Organizations that still rely on unsupported PHP versions should treat this as a priority, not a routine maintenance task. Moving to a supported PHP release, confirming vendor patches, and auditing all PHP-based assets are now essential steps for reducing exposure.
