Key Takeaways:
- PHP2Shell is a critical vulnerability with millions of impacted hosts and websites across the globe (get the current counts here).
- Several factors make exposures hard to track. Numbers differ from source to source.
- Censys’ PHP exposure reporting derives exclusively from its Internet Map, the most accurate, comprehensive, and real-time Internet data in the world.
- Read on for details of how PHP2Shell unfolded, why counts differ, and how Censys builds our map of Internet threats and vulnerabilities.
A messy week for PHP: how PHP2Shell was disclosed
On October 20, PHP announced an emergency release for two pre-auth remote code execution (RCE) flaws in the PHP core, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2. These two vulnerabilities together came to be known as “PHP2Shell.”
That evening, Calif, one of the research teams credited with the discovery, posted a video of its exploit chain running against live targets. It came down quickly. Copies spread anyway. Calif and PHP both describe the post as a mistake. Critics were less charitable.
On October 21, more than six hours before the coordinated release, cyber startup Chainguard published rebuilt PHP images containing the fix. The PHP Foundation said publicly that Chainguard had unilaterally broken the embargo, letting any attacker study the patch in binary form while everyone else waited.
As of publishing, reports of exploitation in the wild change by the hour. At least two security vendors have retracted claims that tied incidents to these exact CVEs, and yet the two vulns have landed in CISA’s Known Exploited Vulnerabilities (KEV).
Then there are the exposure counts. Open any two public charts and they disagree, sometimes by an order of magnitude. Each counted a different object, with a different instrument, at a different hour, and some were never built on the publisher’s own scans at all.
Why do PHP exposure counts disagree?
Whose scanner. Plenty of exposure charts are built by querying someone else’s Internet scan data, licensed or resold, rather than the publisher’s own index. That chart inherits the index’s port coverage, refresh cadence, and matching rules, plus whatever query the publisher wrote on top. Two vendors querying the same index can still publish different numbers.
The unit. An IP, a service, a web app, and a scan response are different objects. One shared-hosting IP can serve thousands of WordPress sites, and one host can run PHP on 80, 443, 8080 and 8443 at once. Censys publishes different measurements for each different aggregation, as they’re all interesting and useful.
Whether PHP says its name. Version data often comes from the X-Powered-By header, which only appears when expose_php is on. Whether a chart drops version-hiding services, counts them as affected or reports them separately can move the headline by tens of millions.
Query mechanics. On an index that matches version strings as text, a search for PHP/5.4.1 also returns 5.4.10 through 5.4.19. Sum the per-version results and the same hosts get counted over and over.
Version strings lie a little. Linux distributions backport security fixes into old version numbers, so a host reporting PHP 8.1 may already be patched. Every banner-based count is an upper bound, ours included.
The hour. A service only moves from affected to fixed when a scanner comes back and sees the new version. Revisit cadence decides how quickly a patch shows up in anyone’s numbers.
Coverage keeps improving. Our own PHP host count increased from initial publication. PHP did not suddenly spread. We improved detection, and an Internet that was already there got easier to see.
How the Internet Map counts
Every number above comes from Censys scanners. We do not license anyone else’s index, so how our own scanners behave decides what those numbers can see.
Censys scans all 65,535 ports, first-party, every day, and fingerprints each open port down to protocol and service. PHP running an admin panel on 8443, or a dev server on a residential ISP, shows up the same way PHP on 443 does. We add roughly 20 new protocols and software fingerprints per week, with hundreds more in development.
We have tested that behavior empirically. Censys reaches a newly exposed host within hours (2 to 11 in our measurements) and revisits each service about every 8 to 14 hours, which is why our patched count moves every day. This is across everything online.
Depth gets the same attention. Censys requests dozens of distinct HTTP paths, including the favicon, well-known files and randomly named paths that show how a server answers for pages that don’t exist, and it holds SSH and telnet sessions open long enough to collect the actual login banner. A scanner that sends one GET / and hangs up after 50 milliseconds sees a thinner Internet. This is across everything online.
Websites are first-class objects. A web property is a name plus a port, resolved through Censys Active DNS, which queries domains itself and timestamps every answer. That is how 4.18 million hosts become 67.6 million web properties: shared hosting stops hiding behind a single IP.
Raw banners get refined into software records with vendor and product attribution, so the PHP2Shell count is a structured query rather than a string match:
(host.services.software: (vendor="php" and product="php")) and not labels:"HONEYPOT"
That honeypot exclusion matters during a mass-exploitation event, when deception infrastructure spins up fast and inflates naive counts.
Finally – history. Censys keeps four years of searchable history and records every change in what a service is running, so patch adoption is a measured curve. That’s how the dashboard can say a specific service moved from affected to fixed, instead of inferring patching from a total that went down.
Then you can leap. From a vulnerable host to its TLS certificate, from the certificate to every other host presenting it, from there to the domains resolving to those hosts, with full scan detail at each hop. Censys is the only place that loop runs end to end across hosts, websites, certificates and DNS.
How do I check if my own hosts are affected?
A global number is situational awareness. The useful question is which of those hosts are yours, and which ones are attacking you.
For your own surface, ARC Rapid Response emails Censys customers within hours when an actively exploited vulnerability like PHP2Shell lands on infrastructure attributed to them.
For the adversary side, the same dataset carries the Reputation Score and threat fingerprints for C2 frameworks and offensive tooling. Take the source IP of a suspicious multipart POST from your logs, enrich it, and pivot to the rest of its infrastructure by hand or with Censys Investigator.
All of it is reachable through the UI, REST API, MCP server, SIEM and SOAR integrations, or a full data download. One dataset answers the census question, the exposure question and the attacker question, without stitching six vendors together.
The next time two exposure charts disagree, ask what each one counted, and whose scanner did the counting, before asking who got it right.
Your entire attack surface, mapped.
Never miss a vulnerability in your environment with Attack Surface Management, powered by Censys’ comprehensive and real-time Map of the Internet.
