The numbers
The numbers in the news, and how far each holds
Every figure that has been repeated about this story, with where it comes from and whether it holds up.
How sure are we?
70 facts- 19 confirmed
- 36 reported
- 8 disputed
- 3 contradicted
- 4 unverified
Every number
70%Not stated. The headline is a restatement of the body's figure for websites.unverified
almost 70%The share of websites whose server-side language is PHP, as commonly published by web-technology surveys. Neither page names the survey.reported
about 30 millionNot stated.reported
2,608,039Hosts observed on the internet that expose PHP, as counted by one scanning vendor.reported
about 6,000Resources identified by the national CERT as potentially affected, in one country.reported
674Rows in the inventory: 206 marked Vulnerable, 46 Fix, 418 Investigation, 3 Not vulnerable, 1 without a status.confirmed
Contested
- contradicted The flaws are CVSS 10.0who says it: social posts on 20 October, relayed by a vendor and a news site
- disputed Remote code execution is confirmed on PHP-FPMwho says it: PHP Foundation blog; GHSA-6wmf for the session path
- unverified The 8.5.12 fix may be incomplete, or there is a third, different bugwho says it: Fediverse posts relayed to oss-security by Aaron Rainbolt and Yves-Alexis Perez
- disputed All PHP versions from 5 onwards are affected by at least one of the flawswho says it: NCSC-NL; Wiz ('>= 5.4'); CERT-FR (5.x, 6.x, 7.x, 8.0, 8.1)
- disputed A web application firewall may provide some protection until systems are patchedwho says it: CISA
That is the page for you.