Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
How much PHP is there, and where does '70%' come from?
How much of the web runs on PHP, by every measure that someone actually measures; and how did one of those measures become '70% of the Internet'? An investigation by the fact-check desk, opened 2026-10-24 at the editor's request; as of 2026-10-24T01:50Z.
The short answer
About 69% of the websites whose server-side language W3Techs can identify, and falling: it was 80.6% in 2015. On every site the HTTP Archive crawls, PHP is detected on about half (48%). WordPress alone, which needs PHP, is on 39.6% of all websites. On the internet, the scanners count PHP on about 2 to 3 million hosts. No one measures a share of 'the Internet'. '70% of the Internet' is a website figure, restated in Wiz's own post, then copied.
The versions of the claim, graded
On the desk's spectrum of evidence, from A0 (nothing carries it) to A6 (the primary record carries it).
- A6 Established●●●●●●
PHP runs about 69-70% of the websites whose server-side language is known
· Count · holdsW3Techs' own page, fetched on 24 October: 69.3% as of 23 October, on 'all the websites whose server-side programming language we know'. The measurer is the primary record of its own measurement. It is one measurer, and W3Techs does not publish what share of sites have a known language. - A1 Weak signal●○○○○○
PHP runs 70% of all websites
· Count · holds in partNo measurer of all websites gives 70%. The one that counts every crawled site, the HTTP Archive, detects PHP on 48.3% of mobile origins (September 2026, the desk's ratio of two published counts); WordPress alone is 39.6% of all sites (W3Techs). 'Of all websites' drops W3Techs' qualifier; W3Techs' own PHP 8 page does the same. The truth is between about 40% and about 70%, depending on what the unknown-language sites run. - A0 Unsupported○○○○○○
70% of the Internet
· Count · not shownNothing measures a share of 'the Internet'. Scanners count PHP on about 2 to 3 million internet-facing hosts (Censys, VulnCheck, Shodan), 5.1 million IP addresses (VirusTotal). The phrase first appears in Wiz's X post at 13:32 UTC on 21 October; the body of Wiz's own blog post says 'websites'. It is a website share restated, a change of denominator, not a measurement. - A2 Reported●●○○○○
75% of websites (Reuters, 'according to W3Techs')
· Count · holds in partW3Techs' yearly table gives 75.2% on 1 January 2025, 72.4% on 1 January 2026 and 69.3% on 23 October 2026. Reuters' 75% matches the January 2025 figure, not the one W3Techs showed when Reuters wrote: an out-of-date number, correctly attributed. - A0 Unsupported○○○○○○
could take down 70% of the internet (Fortune)
· Opinion · not shownFortune's headline and lede, in its own voice, with no source: a usage share became a share that could be taken down. Its only attributed 70% is an accurate quote of Wiz's conclusion. Nothing in the evidence measures what could be taken down.
What the evidence shows
- The measurement exists, and it is W3Techs: 69.3% of the websites whose server-side programming language W3Techs knows, on 23 October 2026. Every outlet that names a measurer names W3Techs.
- It is falling, and has been for a decade: 80.6% in January 2015, 75.2% in January 2025, 72.4% in January 2026, 69.3% now. '70%' is already a rounding up.
- The bigger the site, the less PHP: 64.4% of the top million, 60.9% of the top 100,000, 58.7% of the top 1,000 (W3Techs, known-language sites).
- On all websites, the only measurer that counts every crawled site gives about half: the HTTP Archive detects PHP on 48.3% of mobile origins and 47.3% of desktop origins in September 2026, down from about 58% in January 2023.
- WordPress, which cannot run without PHP, is on 39.6% of all websites (W3Techs): a floor for PHP's share of all sites in that sample.
- Counted in sites rather than shares: BuiltWith 23.96 million live PHP sites, Wappalyzer about 22.7 million. Neither publishes a denominator.
- On the internet, scanners count hosts, not shares: about 2.6 million (Censys, VulnCheck), 1.9 million (Shodan), 5.1 million IP addresses (VirusTotal). Palo Alto's 22.6 million 'instances' (via Fortune) is not in Palo Alto's own advisory and is ten times every other count.
- In the evidence vault, 127 statements of PHP's share in 11 languages, from 94 sources: 39 against 'the Internet' or 'the web', 29 against all websites, 30 with W3Techs' known-language denominator, 23 with no denominator.
- '70% of the Internet' starts with Wiz: its X post at 13:32 UTC on 21 October, then its blog headline and conclusion. The same post's executive summary says 'powers 70% of all websites in the world'. The denominator changes inside the origin, which cites no measurement.
- 17 statements link a measurement; only one of the 39 'Internet' statements does (MediaNama puts a W3Techs link on the words '70% of the internet').
- Re-checked live on 24 October: 73 page records at 68 addresses; 64 unchanged, 4 reworded without a note, 3 blocked, 2 could not be checked, none corrected. Wiz has changed nothing. CNN rewrote its 70% lines twice and still says 'internet' in the headline.
- Outside the 70%: AWS rewrote 'PHP2Shell is now being broadly exploited in the wild' as 'now seeing broad exploitation attempts in the wild', without a note. This site quotes the first wording.
How much PHP there is, by who measures it
Each measurer counts something different, so the measures are kept apart and never added together. The share charts use one axis, in percent; the counts are in a separate chart.
W3Techs: PHP, websites whose server-side language is knownHTTP Archive: PHP, all crawled origins (mobile)W3Techs: WordPress, all websites
The points as a table
| Series | Date | Share |
|---|---|---|
| W3Techs, PHP, known-language sites | 2015-01-01 | 80.6% |
| W3Techs, PHP, known-language sites | 2016-01-01 | 80.0% |
| W3Techs, PHP, known-language sites | 2017-01-01 | 80.0% |
| W3Techs, PHP, known-language sites | 2018-01-01 | 80.2% |
| W3Techs, PHP, known-language sites | 2019-01-01 | 78.9% |
| W3Techs, PHP, known-language sites | 2020-01-01 | 78.9% |
| W3Techs, PHP, known-language sites | 2021-01-01 | 79.1% |
| W3Techs, PHP, known-language sites | 2022-01-01 | 78.1% |
| W3Techs, PHP, known-language sites | 2023-01-01 | 77.7% |
| W3Techs, PHP, known-language sites | 2024-01-01 | 76.7% |
| W3Techs, PHP, known-language sites | 2025-01-01 | 75.2% |
| W3Techs, PHP, known-language sites | 2026-01-01 | 72.4% |
| W3Techs, PHP, known-language sites | 2026-10-23 | 69.3% |
| HTTP Archive, PHP, all origins (mobile) | 2020-01-01 | 51.0% |
| HTTP Archive, PHP, all origins (mobile) | 2021-01-01 | 50.2% |
| HTTP Archive, PHP, all origins (mobile) | 2022-01-01 | 56.9% |
| HTTP Archive, PHP, all origins (mobile) | 2023-01-01 | 58.0% |
| HTTP Archive, PHP, all origins (mobile) | 2024-01-01 | 56.4% |
| HTTP Archive, PHP, all origins (mobile) | 2025-01-01 | 54.6% |
| HTTP Archive, PHP, all origins (mobile) | 2026-01-01 | 52.3% |
| HTTP Archive, PHP, all origins (mobile) | 2026-09-01 | 48.3% |
| W3Techs, WordPress, all sites | 2015-01-01 | 23.3% |
| W3Techs, WordPress, all sites | 2016-01-01 | 25.6% |
| W3Techs, WordPress, all sites | 2017-01-01 | 27.3% |
| W3Techs, WordPress, all sites | 2018-01-01 | 29.2% |
| W3Techs, WordPress, all sites | 2019-01-01 | 32.7% |
| W3Techs, WordPress, all sites | 2020-01-01 | 35.4% |
| W3Techs, WordPress, all sites | 2021-01-01 | 39.5% |
| W3Techs, WordPress, all sites | 2022-01-01 | 43.2% |
| W3Techs, WordPress, all sites | 2023-01-01 | 43.1% |
| W3Techs, WordPress, all sites | 2024-01-01 | 43.1% |
| W3Techs, WordPress, all sites | 2025-01-01 | 43.6% |
| W3Techs, WordPress, all sites | 2026-01-01 | 43.0% |
| W3Techs, WordPress, all sites | 2026-10-24 | 39.6% |
Hosts on the internet counted running PHP
Censys's 54.9 million 'web properties' counts names, not machines, and reaches the vault third-hand; it is in the table below, not the chart. Palo Alto's 22.6 million 'instances' is not in Palo Alto's own advisory.
Websites
| Measure | Value | Over what, and how | As of | Source |
|---|---|---|---|---|
| W3Techs (Q-Success) share of websites whose server-side programming language W3Techs knows that use PHP | 69.3% | all the websites whose server-side programming language we know (within W3Techs' relevant-web sample) Denominator is sites with a KNOWN server-side language, not all websites. W3Techs' free pages do not publish what fraction of sites have a known language (no 'unknown/none' row for this category, unlike CMS). Multiple languages per site allowed. Same page dated 24 Oct 2026 on overview/programming_language/all. | 2026-10-23 | w3techs.com/technologies/details/pl-php fetched by the desk 2026-10-24T01:31:13Z, sha256 f49b114f2c6055e2PHP is used by 69.3% of all the websites whose server-side programming language we know. |
| W3Techs (Q-Success) monthly trend of the same PHP share (known-language sites) | 69.3% | all the websites whose server-side programming language we know Falls about 0.3 points a month: 73.4% on 1 Oct 2025 to 69.3% on 23 Oct 2026. JavaScript (server-side) rose from 5.0% to 8.2% over the same period. | 2026-10-23 | w3techs.com/technologies/history_overview/progra fetched by the desk 2026-10-24T01:32:22Z, sha256 aea4e6acf2397713This report shows the historical trends in the usage of the top server-side programming languages since October 2025. |
| W3Techs (Q-Success) PHP share among known-language sites, by traffic rank band | 64.4% | websites whose server-side programming language we know and that rank in the top 1,000,000 (CrUX plus customised Tranco ranking) Value is top 1M; top 100k 60.9%, top 10k 59.4%, top 1k 58.7%. PHP share falls as traffic rises. | 2026-10-24 | w3techs.com/technologies/breakdown/pl-php/rankin fetched by the desk 2026-10-24T01:37:59Z, sha256 c75051a6d55f368cOverall 69.3% top 1,000,000 64.4% top 100,000 60.9% top 10,000 59.4% top 1,000 58.7% |
| BuiltWith count of live websites BuiltWith detects using PHP | 23,961,854 | BuiltWith's index of websites ('live websites'); also 80,459,242 that used PHP historically Absolute count, no denominator given on the page. History is BuiltWith's own chart series 'Entire Internet' (first point per year plus latest, 2026-08-22). Series peak 30,546,471 on 2020-10-03 (top 1m peak 547,327 same date); last chart point dated 2026-08-22. Bytes were gzip; excerpt from decoded copy. | 2026-08-22 | trends.builtwith.com/framework/PHP fetched by the desk 2026-10-24T01:31:28Z, sha256 467433b45a8db4beWe know of 23,961,854 live websites using PHP and an additional 80,459,242 sites that used PHP historically |
| BuiltWith count of top-1-million sites (BuiltWith traffic ranking) using PHP | 196,288 | BuiltWith's top 1m sites About 19.6% of the top 1M, 13.4% of the top 100k, 13.6% of top 10k, 13.4% of top 1k (our division by the band size). Far below W3Techs' known-language shares: BuiltWith requires a positive PHP signal, W3Techs divides by known-language sites only. | 2026-08-22 | trends.builtwith.com/framework/PHP fetched by the desk 2026-10-24T01:31:28Z, sha256 467433b45a8db4beTraffic Top 1m 196,288 Top 100k 13,440 Top 10k 1,362 Top 1000 134 |
| Wappalyzer count of websites Wappalyzer tracks using PHP | 22,700,000 | websites in Wappalyzer's dataset Rounded count, no denominator published on the page. | 2026-10-24 (retrieved; page gives no date) | wappalyzer.com/technologies/programming-language fetched by the desk 2026-10-24T01:31:28Z, sha256 c96eba601b04e734Wappalyzer tracks about 22,700,000 websites using PHP. |
| HTTP Archive (Tech Report API, Wappalyzer detection) count of origins in the HTTP Archive mobile crawl where PHP is detected | 4,221,648 | origins in the HTTP Archive crawl (CrUX-derived list), mobile client; ALL ranks, ALL geos Desktop 2,606,557. bq/BigQuery not usable (no credentials) so the published Tech Report API at cdn.httparchive.org/v1 (the endpoint httparchive.org's own techreport page calls) was used. | 2026-09-01 | cdn.httparchive.org/v1/adoption?technology=PHP&g fetched by the desk 2026-10-24T01:35:57Z, sha256 2013e7d1b47ecbd2{"date":"2026-09-01","adoption":{"desktop":2606557,"mobile":4221648},"technology":"PHP"} |
| HTTP Archive (Tech Report API, Wappalyzer detection) share of all crawled origins where PHP is detected (mobile), computed from two published counts | 48.3% | all origins in the HTTP Archive mobile crawl (8,739,300 in Sept 2026) Denominator is ALL origins, including those where no language is detectable, which is why it is lower than W3Techs. Desktop share history: 2020-01-01 50.9, 2021-01-01 50.7, 2022-01-01 56.3, 2023-01-01 55.9, 2024-01-01 54.9, 2025-01-01 53.3, 2026-01-01 50.5, 2026-09-01 47.3. Numerator excerpt is in httparchive-php-origins-mobile. | 2026-09-01 | cdn.httparchive.org/v1/adoption?technology=ALL&g fetched by the desk 2026-10-24T01:35:58Z, sha256 2241b8e38794dec3{"date":"2026-09-01","adoption":{"desktop":5515143,"mobile":8739300},"technology":"ALL"} |
Applications built on PHP
| Measure | Value | Over what, and how | As of | Source |
|---|---|---|---|---|
| W3Techs (Q-Success) share of ALL websites (W3Techs sample) using WordPress (a PHP application) | 39.6% | all websites in W3Techs' sample (CMS report includes a 'None' row) Unlike the PHP language figure, this IS a share of all websites. Peaked at 43.6% on 1 Jan 2025 in the yearly trend; 'None' (no monitored CMS) rose from 28.6% (1 Jan 2026) to 32.1% (24 Oct 2026). WordPress alone implies PHP, so 39.6% of all sites is a floor-type figure for PHP on all sites in this sample. | 2026-10-24 | w3techs.com/technologies/details/cm-wordpress fetched by the desk 2026-10-24T01:32:12Z, sha256 c7c819ccd71cea94WordPress is used by 58.3% of all the websites whose content management system we know. This is 39.6% of all websites . |
| W3Techs (Q-Success) share of ALL websites using Joomla / Drupal (PHP CMSs) | 1.1% | all websites in W3Techs' sample Value and history are Joomla (share of all sites). Drupal 0.6% of all sites now; Drupal yearly history (all sites) from the same trend page: 2015 2.0%, 2016 2.1%, 2017 2.2%, 2018 2.3%, 2019 1.9%, 2020 1.7%, 2021 1.5%, 2022 1.3%, 2023 1.2%, 2024 1.1%, 2025 0.9%, 2026 0.8%, 2026-10-24 0.6%. Other PHP CMSs in the list: PrestaShop 0.5%, Bitrix 0.4%, TYPO3 0.3%, OpenCart 0.3%, MODx, phpBB, Moodle 0.1% each. | 2026-10-24 | w3techs.com/technologies/overview/content_manage fetched by the desk 2026-10-24T01:31:26Z, sha256 b363d4408a378f86Joomla 1.1% 1.6% Tilda 0.8% 1.2% Webflow 0.8% 1.2% Duda 0.7% 1.1% Drupal 0.6% 0.9% |
| HTTP Archive (Tech Report API, Wappalyzer detection) share of all crawled mobile origins running WordPress, computed from published counts | 31.1% | all origins in the HTTP Archive mobile crawl Comparable with W3Techs' 39.6%-of-all-sites WordPress figure. | 2026-09-01 | cdn.httparchive.org/v1/adoption?technology=WordP fetched by the desk 2026-10-24T01:35:58Z, sha256 7964a028052a0571{"date":"2026-09-01","adoption":{"desktop":1626771,"mobile":2714694},"technology":"WordPress"} |
| HTTP Archive Web Almanac 2025 (CMS chapter) WordPress share of all websites (mobile) in the 2025 Almanac crawl | 35% | all websites in the HTTP Archive 2025 crawl, mobile 2022-2024 points are from the 2024 chapter (webalmanac-2024-cms.html): 'WordPress was used on 35.1% in 2022, 34.9% in 2023, and 35.6% in 2024'. The Almanac chapters do not give a PHP-language share. | 2025 (Almanac edition) | almanac.httparchive.org/en/2025/cms fetched by the desk 2026-10-24T01:36:11Z, sha256 180e877aeccff347peaking at 35.0% for all websites. |
PHP versions
| Measure | Value | Over what, and how | As of | Source |
|---|---|---|---|---|
| W3Techs (Q-Success) share of PHP websites on PHP major version 8 | 65.3% | all the websites who use PHP (and whose version W3Techs detects) Expressed as share of known-language sites: v8 45.3%, v7 18.6%, v5 5.3%. Version is only known where sites expose it (e.g. X-Powered-By); W3Techs does not state the share of PHP sites with a known version. | 2026-10-23 | w3techs.com/technologies/details/pl-php fetched by the desk 2026-10-24T01:31:13Z, sha256 f49b114f2c6055e2Version 8 is used by 65.3% of all the websites who use PHP. Version 8 65.3% Version 7 26.9% Version 5 7.7% Version 4 0.1% |
| W3Techs (Q-Success) share of PHP websites on PHP major version 7 | 26.9% | all the websites who use PHP Within v7: 7.4 73.4%, 7.3 10.5%, 7.2 8.4%, 7.0 4.0%, 7.1 3.7%. The excerpt is the 7.x subversion split; the 26.9% top-line is in the w3techs-php-v8-share excerpt. All v7 is end-of-life. | 2026-10-23 | w3techs.com/technologies/details/pl-php/7 fetched by the desk 2026-10-24T01:32:43Z, sha256 95b2d636702df6d0Version 7.4 is used by 73.4% of all the websites who use PHP version 7. |
| W3Techs (Q-Success) share of PHP websites on PHP major version 5 | 7.7% | all the websites who use PHP 7.7% of PHP sites = 5.3% of known-language sites. Within v5: 5.6 54.9%, 5.3 15.4%, 5.4 14.7%. | 2026-10-23 | w3techs.com/technologies/details/pl-php/5 fetched by the desk 2026-10-24T01:32:43Z, sha256 a2cd9ba5f26b6db6PHP version 5 is used by 5.3% of all the websites whose server-side programming language we know. |
| W3Techs (Q-Success) split of PHP 8 sites by minor version (8.0/8.1 are end-of-life) | 20.9% | all the websites who use PHP version 8 value = 8.0 + 8.1 = 20.9% of PHP-8 sites (our sum). Derived: supported 8.2-8.5 = 79.1% of v8 = about 51.7% of PHP sites; so roughly 48% of version-detected PHP sites are on EoL branches (our arithmetic, not W3Techs'). | 2026-10-23 | w3techs.com/technologies/details/pl-php/8 fetched by the desk 2026-10-24T01:31:54Z, sha256 2e4782e518ceee75Version 8.3 34.9% Version 8.2 27.6% Version 8.1 15.1% Version 8.4 12.1% Version 8.0 5.8% Version 8.5 4.5% |
| JetBrains State of PHP 2025 share of surveyed PHP developers using PHP 8.x | 89% | PHP developers in the JetBrains Developer Ecosystem survey 2025 Developer self-report, skewed to JetBrains users per its own disclaimer; not site counts. | 2025 | blog.jetbrains.com/phpstorm/2025/10/state-of-php fetched by the desk 2026-10-24T01:36:59Z, sha256 7720d77ce3d68761PHP 8.x dominates with 89% usage, while PHP 7.x has dropped to 33%. Legacy versions (5.6 and earlier) are now down to 8% |
Hosts and servers on the internet
| Measure | Value | Over what, and how | As of | Source |
|---|---|---|---|---|
| Censys (query by Silas Cutler) internet hosts whose service software product is PHP | 2,574,043 | hosts in Censys platform index Primary: the researcher's own published query result. Hosts (IPs), not websites. | 2026-10-22 (capture date; query date not stated) | gist-silascutler-censys-query capture sha256 5cea858eacc35a20For all PHP: host.services.software.product: "PHP" ( 2,574,043 results) |
| Censys (via SecurityWeek) internet-facing hosts running PHP; with identifiable version; unpatched | 2,580,000 | internet-facing hosts seen by Censys on 2026-10-21 Same article: approx. 1.57 million not patched; 'nearly 3 million' hosts as of 22 Oct. Second-hand (news). | 2026-10-21 | securityweek-exploitation-days-before capture sha256 b922b47f8fab0fa8Out of 2.58 million internet-facing hosts seen on October 21, roughly 1.58 million were reporting identifiable PHP versions |
| Censys (via KrebsOnSecurity, via bitpage.de) web properties serving PHP | 54,900,000 | Censys web-property index Third-hand; Krebs article not in the vault. Web properties (names) not hosts. Same German page later cites Censys '34,4 Millionen verwundbare PHP-Dienste'. Born (borncity) reports an unquoted Censys 'php' search giving 7 million hosts and 59 million software products. | 2026-10 (not stated) | bitpage-php2shell-php-sicherheitsluecke-webseite capture sha256 50d84bde38c55c17Censys zählt laut KrebsOnSecurity 2,58 Millionen direkt aus dem Internet erreichbare Hosts mit PHP und 54,9 Millionen Web-Properties, die PHP ausliefern. |
| VulnCheck (via The Hacker News) internet-facing hosts with PHP identified | 2,608,039 | internet-facing hosts in VulnCheck's scan data Same text: about 400,000 on 7.4/8.0/8.1 and 403,000 on supported 8.2-8.5. Second-hand. | 2026-10-21/22 | thehackernews-php2shell-4days capture sha256 c1cb63141287484cVulnCheck's analysis has identified PHP on 2,608,039 internet-facing hosts, out of which over 700,000 hosts run PHP 3.x through 7.3. |
| VirusTotal (via SecurityWeek) IP addresses running PHP; with version announced | 5,100,000 | IP addresses seen by VirusTotal Of 1.1M with a version: approx. 272,000 supported, approx. 758,000 EoL (5.4-8.1). About four in five hide the version. Also in recordedfuture-php2shell and bleepingcomputer-php2shell captures. Second-hand. | 2026-10-21 | securityweek-exploitation-days-before capture sha256 b922b47f8fab0fa8VirusTotal says it sees roughly 5.1 million IP addresses running PHP, but only 1.1 million of them announce a version |
| Mallory (Shodan banner counts, via The Hacker News) hosts whose HTTP banner reports PHP 8.1 or older | 884,000 | internet-facing hosts in Shodan reporting any PHP version (approx. 1.5 million) 59% of the roughly 1.5 million version-reporting hosts. cybelangel capture gives exact 883,717. | 2026-10-20 | thehackernews-php2shell-unpatched-alert capture sha256 33ba8292e26406d7Security company Mallory counted about 884,000 internet-facing hosts whose HTTP banner reported a PHP version of 8.1 or older |
| Shodan (search by Henk Poley, via Tenable) internet-exposed hosts running PHP (Shodan search) | 1,900,000 | Shodan index Direct Shodan fetch was blocked (Cloudflare challenge). Same capture: Silas Cutler's rough estimate of over 1.3 million potentially vulnerable hosts. | 2026-10-21/22 | tenable-php2shell-faq capture sha256 10d98694b9c0243eA Shodan search by Henk Poley counts over 1.9 million internet-exposed hosts running PHP. |
| Palo Alto Networks (as reported by Fortune and others) 'potentially vulnerable instances' / 'internet-exposed servers' (definition unclear) | 22,600,000 | not stated UNVERIFIED and an outlier: about 10x every host count above. Vault curator marks claim scale-22m-paloalto 'unverified': Palo Alto's own advisory (paloalto-psirt-cve-2026-109618) gives no such figure. Claim cur3-22m-servers (TechTarget Japan) 'basis not stated'. Likely counts instances/sites, not hosts. Do not use as a host count without the primary. | 2026-10-22/23 | fortune-ai-tools-php-vulnerability capture sha256 cdcba1b8c212b9e8An initial analysis by cybersecurity firm Palo Alto Networks identified 22.6 million potentially vulnerable instances. |
Packages
| Measure | Value | Over what, and how | As of | Source |
|---|---|---|---|---|
| Packagist.org packages registered on Packagist (the Composer PHP package repository) | 475,515 | Packagist.org registry statistics.json fetched seconds later gave packages 475503, versions 5967561, downloads 207859011119 (live counters). | 2026-10-24 | packagist.org/statistics fetched by the desk 2026-10-24T01:31:28Z, sha256 c81dcafd59845c51Packages registered 475 515 Versions available 5 972 250 Packages installed (since 2012-04-13) 207 858 803 613 |
| Packagist.org cumulative package installs via Composer since 2012-04-13 | 207,858,803,613 | Composer installs served by Packagist.org Installs, not users or sites. Packagist php-statistics page (installs by PHP minor version) is chart-only; numbers not in the static bytes. | 2026-10-24 | packagist.org/statistics fetched by the desk 2026-10-24T01:31:28Z, sha256 c81dcafd59845c51Packages installed (since 2012-04-13) 207 858 803 613 |
Developers
| Measure | Value | Over what, and how | As of | Source |
|---|---|---|---|---|
| Stack Overflow Developer Survey 2025 share of all respondents who worked with PHP in the past year | 18.9% | 2025 survey respondents answering the language question (All Respondents) Excerpt anchors the 'All Respondents' list; the same list continues 'C++ 23.5% PowerShell 23.2% C 22% PHP 18.9% Go 16.4%'.Professional developers 19.1%. 12th language. The 2026 survey page lists only the top 10 languages (PHP not among them); PHP figure for 2026 not in the fetched bytes. | 2025 | survey.stackoverflow.co/2025/technology fetched by the desk 2026-10-24T01:36:27Z, sha256 721a084a2139830bAll Respondents JavaScript 66% HTML/CSS 61.9% SQL 58.6% Python 57.9% |
| TIOBE Index PHP rating in the TIOBE index (search-engine popularity) | 1.26% | TIOBE search-engine hit model Rank 12 in October 2026, 14 a year earlier. Not a usage measure. Page heading 'TIOBE Index for October 2026'. | 2026-10 | tiobe.com/tiobe-index/ fetched by the desk 2026-10-24T01:36:28Z, sha256 d55f43879550643a12 14 PHP 1.26% -0.12% |
Every statement of the share, by time and wording
Websites whose language is knownAll websites'The Internet' or 'the web'Servers or hostsWeb applicationsNo denominator given
Each dot is one statement in the evidence vault, placed at its publication time where the page gives one (otherwise its first capture; each statement says which). A ringed dot is the family's origin; the dashed line is Wiz's X post at 13:32 UTC on 21 October. 14 statements fall outside 21 to 23 October and are in the table. Hover a dot for its words; click it for its row.
What the statements say they measure
| Family | Statements | Measures | Origin |
|---|---|---|---|
| 70% of the Internet / the web (Wiz headline and X post) | 28 | 'The Internet' or 'the web' | S-008 |
| 70% of (all) websites (in the world) (Wiz blog executive summary) | 32 | All websites | S-015 |
| an estimated 70% of websites (OpenAI) | 4 | No denominator given | S-017 |
| almost 70% of websites (Cloudflare, linked to W3Techs) | 3 | No denominator given | S-013 |
| 69.3% / about 70% of websites whose server-side language is known (W3Techs measurement) | 25 | Websites whose language is known | S-004 |
| roughly 75% of websites whose programming language can be identified, per W3Techs (Reuters) | 3 | Websites whose language is known | S-002 |
| "roughly 70%" of the internet, quoted and credited to Wiz (BBC) | 4 | 'The Internet' or 'the web' | S-077 |
| three quarters / two thirds rounding | 5 | All websites | S-001 |
| inflated ranges and ceilings (70-80%, 75-80%, up to 80%) | 4 | No denominator given | S-005 |
| websites and web applications | 3 | Web applications | S-007 |
| servers | 2 | Servers or hosts | S-025 |
| national segments (.pt, .ma) | 2 | Websites whose language is known | S-090 |
| qualitative: a large share / most / the majority (no number) | 12 | No denominator given | S-019 |
The lineage, as a graph
Start at Wiz's X post and walk: which statements belong to which wording, which restate or reword which, and which credit the measurement.
The graph needs JavaScript. The same lineage, by family:
- 70% of the Internet / the web (Wiz headline and X post): 28 statements
- 70% of (all) websites (in the world) (Wiz blog executive summary): 32 statements
- an estimated 70% of websites (OpenAI): 4 statements
- almost 70% of websites (Cloudflare, linked to W3Techs): 3 statements
- 69.3% / about 70% of websites whose server-side language is known (W3Techs measurement): 25 statements
- roughly 75% of websites whose programming language can be identified, per W3Techs (Reuters): 3 statements
- "roughly 70%" of the internet, quoted and credited to Wiz (BBC): 4 statements
- three quarters / two thirds rounding: 5 statements
- inflated ranges and ceilings (70-80%, 75-80%, up to 80%): 4 statements
- websites and web applications: 3 statements
- servers: 2 statements
- national segments (.pt, .ma): 2 statements
- qualitative: a large share / most / the majority (no number): 12 statements
Fortune: 'could take down 70% of the internet'
The editor asked for this one (UF-005.1, board 195). Fortune's article by Emily Forlini, Senior AI Reporter, 2026-10-21T18:48:38Z (datePublished); modified 2026-10-22T14:56:06Z; captured 2026-10-23T01:20Z, as captured in the vault:
- h1:
AI tools discovered the PHP vulnerability that could take down 70% of the internet. Now, the race is on to patch it before AI-powered hackers attack
- html title:
AI helped discover the PHP vulnerability that could take down 70% of the internet | Fortune
- lede:
Today, the defenders are hoping they got a leg up in identifying a critical issue that stands to take down 70% of the internet if left unaddressed.
- quote:
“With 70% of the internet affected, the impact of php2shell cannot be overstated,” Wiz said in a blog post announcing its findings.
- other share sentences:
Most web pages run using an open-source programming language called PHP.
Among the most well known sites that run on PHP is WordPress, which powers roughly 40% of all websites, according to Reuters.
What it credits. The 70% figure is attributed only through the quote of Wiz's conclusion, linked to the Wiz blog. The headline and lede state it in Fortune's own voice with no source. Fortune's one W3Techs link (anchor 'according to') supports a list of example PHP sites (Microsoft.com, Wikipedia.org, Archive.org, TheGuardian.com, Baidu.com), not the share; the WordPress 40% is credited to Reuters.
Against Wiz. Fortune quotes the Wiz conclusion accurately (only 'Internet' to 'internet' and 'PHP2Shell' to 'php2shell'). But its headline and lede change Wiz's verb: Wiz wrote 'affecting 70% of the Internet' and 'With 70% of the Internet affected'; Fortune wrote 'could take down 70% of the internet' and 'stands to take down 70% of the internet if left unaddressed'. Usage share becomes the share that could be knocked offline. Fortune does not use Wiz's other wording, 'powers 70% of all websites in the world'.
Against W3Techs. W3Techs measures PHP on 69.3% (21 Oct, as cited by Tenable, Bitpage, AI4Business, Critic Arad, BDM, Marketing4eCommerce, TechTarget Japan) of websites whose server-side programming language it can identify: a usage share among sites with a detectable language, not of all websites, not of 'the internet', and not of exposure. Fortune links W3Techs but not for this figure, keeps no qualifier, and turns the denominator into 'the internet' and the measure into what could be 'taken down'. Its body does carry a softer qualitative line ('Most web pages run using ... PHP').
Between its own versions. H1 'AI tools discovered...' versus <title>/og:title 'AI helped discover...': the AI claim is softened between headline versions; the 70% wording stays.
Statements S-048, S-049, S-050, S-051; graded above as could take down 70% of the internet
.
Did anyone correct it?
Every page in the vault that uses the figure, and every page the corrections liaison has written to, was fetched again on 24 October and compared with its capture: 64 unchanged, 4 reworded, 3 blocked, 2 could not be checked, and none corrected. Every change the desk found, the figure's and others on the same pages:
| Who | What changed | Before | After |
|---|---|---|---|
| CNN Business | headline | Global websites shut down after AI found a critical flaw affecting 70% of the internet 2026-10-22T08:09:52Z (vault capture) | Websites shut down globally after AI finds a critical flaw affecting 70% of the internet 2026-10-22T11:26:16Z (vault capture of the -intl URL; dateModified 2026-10-22T11:06:26Z) |
| CNN Business | headline | Websites shut down globally after AI finds a critical flaw affecting 70% of the internet 2026-10-22T11:26:16Z (vault capture) | Websites shut down globally after AI finds cybersecurity flaw affecting 70% of the internet page says Updated Oct 22, 2026, 2:26 PM ET (dateModified 2026-10-22T18:26:13Z); fetched 2026-10-24 |
| CNN Business | body | a programming language that powers 70% of all websites in the world, including WordPress and Drupal 2026-10-22T11:26:16Z (vault capture) | a programming language that powers 70% of the world’s websites Updated Oct 22, 2026, 2:26 PM ET; fetched 2026-10-24 |
| CNN Business | body | after artificial intelligence helped discover and address critical bugs that could affect 70% of the internet 2026-10-22T08:09:52Z (vault capture, original URL) | Governments and companies around the world are racing to fix vulnerabilities revealed by artificial intelligence that could affect 70% of the world’s websites Updated Oct 22, 2026, 2:26 PM ET; fetched 2026-10-24 |
| Wikipedia | body | that allow [[Arbitrary code execution|remote code execution]] (RCE). Their existence was publicly announced on 20 October 2026. revision 1381578822, 2026-10-23T13:11Z | with the two vulnerabilities estimated to affect nearly 70% of the commercial world wide web. revision 1381581724, 2026-10-23T13:41:34Z (editor Masem); still in 1381672424, 2026-10-24T01:37Z |
| AWS Security Blog | body | PHP2Shell is now being broadly exploited in the wild. 2026-10-22T11:17:55Z (vault capture; article:modified_time 2026-10-21T21:36:56-07:00) | PHP2Shell is now seeing broad exploitation attempts in the wild. article:modified_time 2026-10-22T14:25:03-07:00; fetched 2026-10-24 |
| BBC News | body | with cyber-security firm Wiz estimating that "roughly 70%" of the internet is affected, though the BBC is unable to independently verify that figure entry published 2026-10-22T06:15:41Z (still on ?page=3, fetched 2026-10-24T01:34:20Z) | According to cyber-security firm Wiz, which helped uncover the critical PHP vulnerabilities surfaced this week, PHP powers 70% of the world’s websites later entries 13:54 and 16:27 UTC, 22 Oct (live page, fetched 2026-10-24) |
| 20 minutes (20min.ch) | headline | Panne mondiale des sites web: la Suisse romande touchée 2026-10-22T08:14:21Z (vault capture) | Panne mondiale: la Suisse romande fortement impactée 2026-10-22T18:16:08Z (vault capture) and live 2026-10-24 |
| The Record | correction-note | not there vault capture | Correction: A previous version of this article used an incorrect pronoun for Detectify researcher Joviane Jardim. fetched 2026-10-24 |
All 127 statements
The full table
| # | When (UTC) | Who | The words | Measures | Credits | Role | sha256 |
|---|---|---|---|---|---|---|---|
| S-001 | 2025-09-03T00:40:32Z | php[architect] capture | powers nearly three-quarters of all websites on the internet | All websites nearly | none | restates | 95189f8e2e19 |
| S-002 | 2026-10-21T07:46:45Z | rte.ie capture | PHP runs roughly 75% of websites whose programming language can be identified, according to web technology tracker W3Techs | Websites whose language is known roughly | W3Techs | origin | 99bb92662561 |
| S-003 | 2026-10-21T07:46:45Z | rte.ie capture | He said the popular programme is used by 70% of websites worldwide. | All websites none | Brian Honan (cybersecurity expert, RTE interview) | restates | 99bb92662561 |
| S-004 | 2026-10-21T09:01:24Z | Tenable capture | According to W3Techs, PHP is used by 69.3% of websites whose server-side language is known. | Websites whose language is known none | W3Techs links the measurement | measures | 10d98694b9c0 |
| S-005 | 2026-10-21T10:38:58Z | SOCRadar capture | The exposure is large. PHP powers up to 80% of websites. | No denominator given up to | none | transforms | 88edcdf127e0 |
| S-006 | 2026-10-21T11:41:07Z | cyberkendra.com capture | PHP runs on about 70% of websites whose server-side language is known, according to W3Techs. | Websites whose language is known about | W3Techs links the measurement | measures | c604df6084ae |
| S-007 | 2026-10-21T12:31:18Z | www.clickx.be capture | On estime qu’environ 70 % des sites web ou des applications web fonctionnent sous PHP. It is estimated that around 70% of websites or web applications run on PHP. | Web applications around | none ('on estime') | transforms | f1876f8dd430 |
| S-008 | 2026-10-21T13:32:25Z | Wiz (@wiz_io) capture | Research uncovers #PHP2SHELL, a decade-old PHP Core vulnerability reaching CVSS 9.2 severity impacting 70% of the Internet. | 'The Internet' or 'the web' none | Wiz (own claim) | origin | 6c1797766281 |
| S-009 | 2026-10-21T13:40:02Z | CyberScoop capture | PHP runs between 70-80% of websites whose server-side language is known, according to market research | Websites whose language is known between 70-80% | 'market research' (unnamed) | transforms S-004 | b47b3a5031e3 |
| S-010 | 2026-10-21T13:47:21Z | Imperva Threat Research (Nadav Avital, Bar Menachem) capture | With PHP used by over 69% of websites whose server-side programming language is known, the potential exposure is substantial. | Websites whose language is known over | none (W3Techs wording, no link) | restates S-004 | 3da873bdb212 |
| S-011 | 2026-10-21T13:48:03Z | globalnews.ca capture | a serious vulnerability in the code that underpins roughly 70 per cent of the world’s websites. | All websites roughly | none | restates S-015 | 87d2ae5079c3 |
| S-012 | 2026-10-21T13:53:36Z | Fastly capture | PHP – the runtime behind most of the web's content management systems, ecommerce platforms, and publishing infrastructure | Web applications most | none | restates | bacf27615fe1 |
| S-013 | 2026-10-21T13:56:45Z | Cloudflare capture | PHP is used by almost 70% of websites. | No denominator given almost | W3Techs (by hyperlink only) links the measurement | measures | 302408765abf |
| S-014 | 2026-10-21T13:59:59Z | Wiz (Wiz Research) capture | PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | 'The Internet' or 'the web' none | Wiz (own claim) | restates S-008 | e3568b6f88c9 |
| S-015 | 2026-10-21T13:59:59Z | Wiz (Wiz Research) capture | a popular general-purpose scripting language that powers 70% of all websites in the world. | All websites none | Wiz (own claim) | origin | e3568b6f88c9 |
| S-016 | 2026-10-21T13:59:59Z | Wiz (Wiz Research) capture | With 70% of the Internet affected, the impact of PHP2Shell cannot be overstated. | 'The Internet' or 'the web' none | Wiz (own claim) | transforms S-015 | e3568b6f88c9 |
| S-017 | 2026-10-21T14:04:23Z | OpenAI (@OpenAI) capture | critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites. | No denominator given an estimated | none (OpenAI's own estimate) | origin | 785b7cae55e3 |
| S-018 | 2026-10-21T14:07:05Z | bleepingcomputer.com capture | PHP (Hypertext Preprocessor) is an open-source, server-side web development language that powers 75% to 80% of all websites | All websites 75% to 80% | none | transforms | ad35f92f5f9b |
| S-019 | 2026-10-21T14:44:34Z | boursorama.com capture | PHP est utilisé sur une grande partie d'Internet PHP is used on a large part of the Internet | 'The Internet' or 'the web' a large part | Reuters (wire copy) | origin | cc4667b91c74 |
| S-020 | 2026-10-21T14:53:56Z | TPO.nl capture | de taal waarop volgens de PHP Foundation en beveiligingsbedrijf Wiz zo’n 70 procent van de websites draait. the language on which, according to the PHP Foundation and security firm Wiz, around 70 percent of websites run. | No denominator given around | PHP Foundation and Wiz | restates S-015 | 2ddfd8817abf |
| S-021 | 2026-10-21T14:53:56Z | TPO capture | de taal waarop volgens de PHP Foundation en beveiligingsbedrijf Wiz zo’n 70 procent van de websites draait. the language on which, according to the PHP Foundation and security firm Wiz, around 70 percent of websites run. | No denominator given around | PHP Foundation and Wiz | restates S-015 | 2ddfd8817abf |
| S-022 | 2026-10-21T15:16:54Z | OpenAI Developer Community (user 'sps', Leader) capture | an open-source programming language used to run an estimated 70% of websites. | No denominator given an estimated | OpenAI | restates S-017 | 43afe7a0a3b9 |
| S-023 | 2026-10-21T15:35:00Z | Search Engine Roundtable capture | it can allow for unauthenticated remote code execution (RCE) and memory disclosure across roughly 70% of the world's websites. | No denominator given roughly | none | restates S-015 | ced33ac29436 |
| S-024 | 2026-10-21T15:36:14Z | actu17.fr capture | D'après le Wall Street Journal, PHP fait fonctionner jusqu'à 70 % des sites internet dans le monde. Ce chiffre correspond à la part des sites qui utilisent ce langage According to the Wall Street Journal, PHP runs up to 70% of websites in the world. This figure is the share of sites that use the language, not the number of sites actually vulnerable. | No denominator given up to | Wall Street Journal | restates | 84edb7f59b55 |
| S-025 | 2026-10-21T15:41:00Z | jn.pt capture | A linguagem PHP é a base da mais de 70% dos servidores da Internet. The PHP language is the basis of more than 70% of Internet servers. | Servers or hosts over | none | transforms S-008 | d0ab59960081 |
| S-026 | 2026-10-21T15:48:36Z | USA Today capture | A critical security issue in a programming language used in as much as 70% of websites has put much of the internet at risk | No denominator given as much as | none | restates | ad354dc6d75d |
| S-027 | 2026-10-21T15:48:36Z | USA Today capture | Critical security flaw puts most websites at risk as NSA issues warning | No denominator given most | none | restates | ad354dc6d75d |
| S-028 | 2026-10-21T15:48:36Z | USA Today capture | critical flaws affecting the technology powering nearly three-quarters of the internet | 'The Internet' or 'the web' nearly | none | transforms | ad354dc6d75d |
| S-029 | 2026-10-21T15:48:36Z | USA Today capture | It is used by roughly 70% of websites whose server-side programming language is known. | Websites whose language is known roughly | none (W3Techs wording) | restates S-004 | ad354dc6d75d |
| S-030 | 2026-10-21T15:48:36Z | USA Today capture | PHP, the underlying technology that powers three-quarters of websites worldwide. | All websites none | none | transforms | ad354dc6d75d |
| S-031 | 2026-10-21T15:48:36Z | USA Today capture | The open-source software is used by about 70% of websites globally. | All websites about | none | restates S-015 | ad354dc6d75d |
| S-032 | 2026-10-21T15:48:36Z | USA Today capture | nearly 70% of all websites that have a known server-side language (when users can identify a site’s programming language) use a PHP, according to web tech survey platform W3Techs. | Websites whose language is known nearly | W3Techs | measures | ad354dc6d75d |
| S-033 | 2026-10-21T15:58:02Z | abc.net.au capture | PHP runs about 75 per cent of websites whose programming language can be identified, according to web technology tracker W3Techs. | Websites whose language is known about | W3Techs | measures | 84937c7c5b87 |
| S-034 | 2026-10-21T16:12:21Z | therecord.media capture | Some estimates show that more than 70% of all websites on the internet use PHP. | All websites more than | 'some estimates' (link to Wiz blog) | transforms S-015 | 39efe473da41 |
| S-035 | 2026-10-21T16:12:21Z | therecord.media capture | used to build and run web applications and the vast majority of websites | No denominator given the vast majority | none | transforms | 39efe473da41 |
| S-036 | 2026-10-21T16:25:58Z | insurancebusinessmag.com capture | two critical bugs in software that runs around 70% of the web. | 'The Internet' or 'the web' around | none | transforms | daa04c79edfb |
| S-037 | 2026-10-21T16:25:58Z | insurancebusinessmag.com capture | two critical flaws in PHP, the code behind most of the internet. | 'The Internet' or 'the web' most | none | transforms | daa04c79edfb |
| S-038 | 2026-10-21T16:25:58Z | insurancebusinessmag.com capture | According to W3Techs, PHP runs around 70% of websites whose server-side language can be identified. | Websites whose language is known around | W3Techs links the measurement | measures | daa04c79edfb |
| S-039 | 2026-10-21T16:25:58Z | Insurance Business (Matthew Sellers) capture | According to W3Techs, PHP runs around 70% of websites whose server-side language can be identified. | Websites whose language is known around | W3Techs links the measurement | measures | 89357150e0bc |
| S-040 | 2026-10-21T16:36:24Z | cnn.com capture | after artificial intelligence helped discover and address critical bugs that could affect 70% of the internet. | 'The Internet' or 'the web' none | none (Wiz linked elsewhere in the story) | restates S-014 | 81bf5a9a7a84 |
| S-041 | 2026-10-21T16:36:24Z | cnn.com capture | PHP2Shell: AI helped find a critical security flaw affecting 70% of the internet | 'The Internet' or 'the web' none | none | restates S-014 | d6d531efb9e3 |
| S-042 | 2026-10-21T16:36:24Z | CNN capture | two critical flaws in PHP, a programming language that powers 70% of all websites in the world | All websites none | none | restates S-015 | ee49fc4265ae |
| S-043 | 2026-10-21T16:36:24Z | CNN capture | Websites shut down globally after AI finds a critical flaw affecting 70% of the internet | 'The Internet' or 'the web' none | none | restates S-014 | ee49fc4265ae |
| S-044 | 2026-10-21T16:50:40Z | SecurityWeek capture | Because the security defects are in PHP itself, they impact 70% of all websites in the world, independent of their CMS. | All websites none | none explicit (paragraph follows 'According to Wiz') | restates S-015 | b63772dddccf |
| S-045 | 2026-10-21T17:55:56Z | la Repubblica capture | W3Techs, società che rileva le tecnologie impiegate nei siti Internet, misura l’uso di PHP nel 69,3% dei siti dei quali riesce a identificare il linguaggio. W3Techs, a company that tracks the technologies used on websites, measures PHP use at 69.3% of the sites whose language it can identify. | Websites whose language is known none | W3Techs links the measurement | measures | 15cece224827 |
| S-046 | 2026-10-21T17:58:25Z | David Lopez-Kurtz (Substack) capture | The Wall Street Journal’s headline puts “up to 70%” of the world’s websites at risk. The closest public number is W3Techs’ count of PHP on 69.3 percent | Websites whose language is known none | WSJ (headline) and W3Techs (measurement) links the measurement | measures | cb3714dc12f9 |
| S-047 | 2026-10-21T18:12:20Z | Paperjam capture | PHP fait fonctionner près de 70% des sites dont le langage côté serveur peut être identifié dans le monde, selon W3Techs. PHP runs nearly 70% of sites worldwide whose server-side language can be identified, according to W3Techs. | Websites whose language is known nearly | W3Techs | measures | 73aed7ccd645 |
| S-048 | 2026-10-21T18:48:38Z | Fortune capture | AI tools discovered the PHP vulnerability that could take down 70% of the internet. | 'The Internet' or 'the web' none | none | transforms S-014 | cdcba1b8c212 |
| S-049 | 2026-10-21T18:48:38Z | Fortune capture | AI helped discover the PHP vulnerability that could take down 70% of the internet | Fortune | 'The Internet' or 'the web' none | none | transforms S-014 | cd967fa20c09 |
| S-050 | 2026-10-21T18:48:38Z | Fortune capture | identifying a critical issue that stands to take down 70% of the internet if left unaddressed. | 'The Internet' or 'the web' none | none | transforms S-016 | cdcba1b8c212 |
| S-051 | 2026-10-21T18:48:38Z | Fortune capture | “With 70% of the internet affected, the impact of php2shell cannot be overstated,” Wiz said in a blog post announcing its findings. | 'The Internet' or 'the web' none | Wiz (blog post, linked) | restates S-016 | cdcba1b8c212 |
| S-052 | 2026-10-21T18:55:05Z | AG Connect capture | Naar schatting gebruikt ongeveer 70 procent van alle websites wereldwijd PHP of een voortvloeisel daarvan. By estimate, around 70 percent of all websites worldwide use PHP or a derivative of it. | All websites an estimated, around | none | restates S-015 | 505809e89b53 |
| S-053 | 2026-10-21T18:59:13Z | The Record (Recorded Future News) capture | Some estimates show that more than 70% of all websites on the internet use PHP. | All websites more than | 'some estimates' (link to Wiz blog) | restates S-034 | 28c72344e03a |
| S-054 | 2026-10-21T19:03:58Z | newsweek.com capture | Wiz Research estimates that PHP powers roughly 70 percent of websites worldwide, though that does not mean 70 percent of websites are vulnerable | All websites roughly | Wiz Research | restates S-015 | dc7ff69a1e38 |
| S-055 | 2026-10-21T19:03:58Z | Newsweek capture | Wiz Research estimates that PHP powers roughly 70 percent of websites worldwide, though that does not mean 70 percent of websites are vulnerable | All websites roughly | Wiz Research | restates S-015 | 323ccf78f4d6 |
| S-056 | 2026-10-21T20:29:17Z | abc.net.au capture | a vulnerability was discovered in 70 per cent of the world's websites by an OpenAI tool | All websites none | none | transforms | a86331d9b7a2 |
| S-057 | 2026-10-21T22:03:43Z | PCMag capture | The flaw affects PHP, a scripting language used by an estimated 70% of websites. | No denominator given an estimated | none | restates S-017 | 82ef905cd220 |
| S-058 | 2026-10-21T23:02:57Z | The Register capture | adding the oft-quoted stat that PHP powers 70 percent of all websites in the world. | All websites none | Wiz researchers (Tzadik, Tamari, Ohfeld, Schwartz) | restates S-015 | b355691c9b58 |
| S-059 | 2026-10-21T23:02:59Z | Feross Aboukhadijeh (@feross) on X capture | PHP runs 69% of websites whose server-side language is known. | Websites whose language is known none | none | restates S-004 | de7648491d66 |
| S-060 | 2026-10-21T23:49:29Z | RTVE.es capture | está presente en cerca del 70% de las páginas web con lenguaje identificable it is present on around 70% of web pages with an identifiable language | Websites whose language is known around | none | restates S-004 | 0c7f8e327e5c |
| S-070 | 2026-10-22T00:59:56Z | Insurance Business capture | crucial bugs found in software that runs around 70% of the web | 'The Internet' or 'the web' around | none | restates S-036 | 8d88bddde485 |
| S-071 | 2026-10-22T00:59:56Z | Insurance Business capture | Web technology tracker W3Techs puts PHP’s share at around 70% of websites whose server-side language it can identify. | Websites whose language is known around | W3Techs links the measurement | measures | 8d88bddde485 |
| S-072 | 2026-10-22T01:09:00Z | Information Age (ACS) capture | PHP is estimated to be used on around 70 per cent of the world's websites and web applications. | Web applications around | none | transforms | 640f80b25de7 |
| S-073 | 2026-10-22T01:39:26Z | Trak.in capture | 70% Websites At Security Risk Due To Critical PhP Vulnerability: PHP2Shell | No denominator given none | none | transforms S-015 | 019553b7a67c |
| S-074 | 2026-10-22T01:39:26Z | Trak.in capture | PHP powers an estimated 70% of websites worldwide, according to Wiz’s research. | All websites an estimated | Wiz | restates S-015 | 019553b7a67c |
| S-075 | 2026-10-22T02:10:00Z | NSA Cybersecurity (@NSACyber) capture | the NSA just told 70% of the internet to “turn it off and on again” except the “on again” part is optional | 'The Internet' or 'the web' none | none | restates S-008 | 899e5ba4af69 |
| S-076 | 2026-10-22T06:04:52Z | COMPUTERWORLD ESPAÑA capture | PHP sustenta el 70% de los sitios web, lo que supone un enorme riesgo de concentración. PHP supports 70% of websites, which represents an enormous concentration risk. | All websites none | none (follows a quote of Forrester analyst Madelein van der Hout) | restates S-015 | e008b157b0ff |
| S-077 | 2026-10-22T06:16:24Z | BBC News capture | with cyber-security firm Wiz estimating that "roughly 70%" of the internet is affected, though the BBC is unable to independently verify that figure. | 'The Internet' or 'the web' roughly | Wiz | transforms S-016 | df1dbe6b553a |
| S-078 | 2026-10-22T06:21:47Z | Bitpage.de capture | Laut W3Techs läuft PHP auf 69,3 Prozent aller Webseiten, deren serverseitige Sprache bekannt ist, Stand 21. Oktober. According to W3Techs, PHP runs on 69.3 percent of all websites whose server-side language is known, as of 21 October. | Websites whose language is known none | W3Techs links the measurement | measures | 50d84bde38c5 |
| S-079 | 2026-10-22T06:21:47Z | Bitpage.de capture | obwohl zwei Drittel des Webs auf ihrer Arbeit laufen although two thirds of the web run on their work | 'The Internet' or 'the web' none | none | transforms S-078 | 50d84bde38c5 |
| S-080 | 2026-10-22T06:25:10Z | 20min.ch capture | a des failles qui mettent en danger «70% du web mondial».AFP has flaws that endanger '70% of the global web'. (AFP) | 'The Internet' or 'the web' none | quoted, source unnamed (photo caption credited AFP) | restates S-014 | 97a639a7c23e |
| S-081 | 2026-10-22T06:25:10Z | 20min.ch capture | un langage de programmation utilisé par environ 70% des sites web dont la technologie est identifiée a programming language used by around 70% of websites whose technology is identified | Websites whose language is known around | none | restates S-004 | 97a639a7c23e |
| S-082 | 2026-10-22T06:25:10Z | 20 minutes / 20 Minuten capture | a des failles qui mettent en danger «70% du web mondial».AFP has flaws that endanger '70% of the global web'. | 'The Internet' or 'the web' none | quoted, source unnamed | restates S-080 | d8cc82c5b6a9 |
| S-083 | 2026-10-22T06:25:10Z | 20 minutes / 20 Minuten capture | un langage de programmation utilisé par environ 70% des sites web dont la technologie est identifiée a programming language used by around 70% of websites whose technology is identified | Websites whose language is known around | none | restates S-081 | d8cc82c5b6a9 |
| S-084 | 2026-10-22T06:39:12Z | ORF capture | Nach Einschätzung des US-israelischen Cybersicherheitsunternehmen Wiz basieren etwa 70 Prozent der weltweiten Websites auf PHP. According to the assessment of the US-Israeli cybersecurity company Wiz, about 70 percent of the world's websites are based on PHP. | All websites around | Wiz | restates S-015 | e88c6f39edbd |
| S-085 | 2026-10-22T06:54:10Z | The Cyber Express capture | It estimates “roughly 70%” of the internet is affected; a figure not independently verified. | 'The Internet' or 'the web' roughly | Wiz | restates S-077 | f45bc7599367 |
| S-086 | 2026-10-22T07:06:28Z | tagesspiegel.de capture | PHP, auf der ein Großteil des gesamten Internets basiert PHP, on which a large part of the entire Internet is based | 'The Internet' or 'the web' a large part | none (dpa wire) | transforms | 0255857572a7 |
| S-087 | 2026-10-22T07:28:03Z | AI4Business capture | Secondo W3Techs, il 21 ottobre il linguaggio era impiegato dal 69,3% dei siti dei quali è identificabile la tecnologia server. According to W3Techs, on 21 October the language was used by 69.3% of the sites whose server technology is identifiable. | Websites whose language is known none | W3Techs links the measurement | measures | 0a757e69b13b |
| S-088 | 2026-10-22T07:41:00Z | cnnportugal.iol.pt capture | De acordo com a empresa de cibersegurança Wiz, “cerca de 70%” de toda a Internet estará a ser afetada por este problema According to cybersecurity firm Wiz, 'around 70%' of the whole Internet is being affected by this problem | 'The Internet' or 'the web' around | Wiz | restates S-077 | de3c73071788 |
| S-089 | 2026-10-22T07:47:00Z | Koran Jakarta ® capture | Perusahaan keamanan siber Wiz memperkirakan "sekitar 70%" internet terpengaruh oleh celah keamanan PHP. Cybersecurity firm Wiz estimates 'around 70%' of the internet is affected by the PHP security flaw. | 'The Internet' or 'the web' around | Wiz (via BBC report) | restates S-077 | f5c3e92816a8 |
| S-090 | 2026-10-22T07:50:00Z | SAPO Tek capture | Entre os sites com domínio .pt cuja tecnologia é identificável, 74,4% correm em PHP Among .pt sites whose technology is identifiable, 74.4% run on PHP | Websites whose language is known none | W3Techs links the measurement | measures | 7203d6e735dd |
| S-091 | 2026-10-22T07:50:00Z | SAPO Tek capture | o PHP, a linguagem em que corre a maior parte da web PHP, the language most of the web runs on | 'The Internet' or 'the web' most | none | restates | 7203d6e735dd |
| S-092 | 2026-10-22T07:57:42Z | 20Minutos capture | Dos fallos "críticos" en el lenguaje de programación PHP ponen en riesgo cerca del 70% de las páginas web de todo el mundo Two 'critical' flaws in the PHP programming language put at risk around 70% of the web pages in the whole world | All websites around | none | transforms S-015 | 96ea536b04fe |
| S-093 | 2026-10-22T08:14:41Z | Yahoo!ニュース capture | 世界の7割で使用『PHP』とは？ What is 'PHP', used by 70% of the world? | No denominator given none | none | restates S-015 | 3f6309ea905a |
| S-094 | 2026-10-22T08:14:41Z | Yahoo!ニュース capture | 世界のサイト7割が危険に 70% of the world's sites at risk | All websites none | none | transforms S-015 | 3f6309ea905a |
| S-095 | 2026-10-22T08:30:11Z | Linternaute.com capture | un langage de programmation qui structure près de 70% des sites web dans le monde. a programming language that structures nearly 70% of websites in the world. | All websites nearly | none | restates S-015 | 940e7811d3ae |
| S-096 | 2026-10-22T09:02:38Z | Critic Arad capture | E în PHP însuși, limbajul pe care rulează aproximativ 70% din web. It is in PHP itself, the language on which approximately 70% of the web runs. | 'The Internet' or 'the web' approximately | none | transforms | 2f3acccf1221 |
| S-097 | 2026-10-22T09:02:38Z | Critic Arad capture | potrivit W3Techs, PHP rulează pe 69,3% dintre site-urile cu limbaj server identificabil. according to W3Techs, PHP runs on 69.3% of sites with an identifiable server language. | Websites whose language is known none | W3Techs links the measurement | measures | 2f3acccf1221 |
| S-098 | 2026-10-22T09:27:00Z | Cybernews capture | the programming language underpinning about 70% of known websites on the internet. | Websites whose language is known about | none | restates S-004 | a5ebfc60c25f |
| S-099 | 2026-10-22T09:32:58Z | BDM capture | PHP fait fonctionner 69,3 % des sites dont le langage serveur est identifié, selon W3Techs PHP runs 69.3% of sites whose server language is identified, according to W3Techs | Websites whose language is known none | W3Techs links the measurement | measures | 795b299b2ea0 |
| S-100 | 2026-10-22T10:10:00Z | Infosecurity Magazine capture | PHP is used by approximately 69.7% of websites whose server-side programming language is known, according to recent W3Techs data. | Websites whose language is known approximately | W3Techs links the measurement | measures | 723f0a0bfb53 |
| S-101 | 2026-10-22T10:53:21Z | Mashable India capture | About 70 percent of websites run on PHP, according to Wiz Research, the security firm that found the bugs. | No denominator given about | Wiz Research | restates S-015 | 072bc5f150b2 |
| S-102 | 2026-10-22T10:53:21Z | Mashable India capture | PHP2Shell Vulnerability That Is Affecting 70% Of Internet | 'The Internet' or 'the web' none | none | restates S-014 | 072bc5f150b2 |
| S-103 | 2026-10-22T11:12:29Z | Wikipedia (English) capture | Approximately 69% of websites use PHP, including those that use content management systems such as Drupal, Joomla, and WordPress | No denominator given approximately | refs [24][25] (ref 24 is NBC News, Kevin Collier) | restates S-004 | bbb51bbd0695 |
| S-104 | 2026-10-22T11:23:30Z | salzburg24 capture | Ungefähr zwei Drittel bis drei Viertel aller Websites bauen auf PHP auf. Roughly two thirds to three quarters of all websites are built on PHP. | All websites roughly two thirds to three quarters | none | restates | c08f50a22621 |
| S-105 | 2026-10-22T11:40:23Z | Marketing4eCommerce capture | Según datos de W3Techs, PHP está presente en el 69,3% de las webs con lenguaje de servidor identificado. Otras estimaciones sitúan su presencia entre el 72% y el 79%. According to W3Techs data, PHP is present on 69.3% of websites with an identified server language. Other estimates put its presence between 72% and 79%. | Websites whose language is known none | W3Techs; 'other estimates' 72-79% unnamed; BuiltWith for a count links the measurement | measures | f6697167654f |
| S-106 | 2026-10-22T12:22:17Z | East Anglian Daily Times (PA) capture | the programming language PHP, used by almost 70% of websites according cybersecurity firm Cloudflare. | No denominator given almost | Cloudflare | restates S-013 | 4c8556b5aaed |
| S-107 | 2026-10-22T12:22:17Z | East Anglian Daily Times (PA) capture | a critical security flaw in a programming language used by the majority of websites | No denominator given the majority | none | restates | 4c8556b5aaed |
| S-108 | 2026-10-22T12:36:54Z | Morocco World News capture | is used by 75.4% of .ma websites whose server-side language can be identified, according to W3Techs data. | Websites whose language is known none | W3Techs | measures | 56b8e97d863b |
| S-109 | 2026-10-22T12:47:51Z | MediaNama capture | PHP, the programming language behind around 70% of the internet | 'The Internet' or 'the web' around | W3Techs (by hyperlink only) links the measurement | transforms | b30b86dc910d |
| S-110 | 2026-10-22T13:09:12Z | BleepingComputer capture | PHP (Hypertext Preprocessor) is an open-source web development language that powers up to 80% of all websites on the Internet | All websites up to | none | transforms S-018 | 2978662261ce |
| S-111 | 2026-10-22T13:38:41Z | Clarin (English edition) capture | How AI uncovered a massive 14-year-old flaw threatening 70% of the internet | 'The Internet' or 'the web' none | none | restates S-014 | c11dd717273b |
| S-112 | 2026-10-22T13:38:41Z | Clarin (English edition) capture | The open-source language serves as the backbone of roughly 70 percent of all web applications and websites worldwide | Web applications roughly | none | transforms S-015 | c11dd717273b |
| S-113 | 2026-10-22T13:38:41Z | Clarin (English edition) capture | an open-source programming language used to run an estimated 70% of websites. | No denominator given an estimated | OpenAI (embedded X post) | restates S-017 | c11dd717273b |
| S-114 | 2026-10-22T14:41:29Z | TuttoTech.net capture | Secondo W3Techs, PHP è utilizzato da circa il 75% dei siti web per i quali è possibile identificare il linguaggio di programmazione. According to W3Techs, PHP is used by around 75% of websites whose programming language can be identified. | Websites whose language is known around | W3Techs | restates S-002 | cd3f99c6c9f9 |
| S-115 | 2026-10-22T15:12:27Z | The Verge capture | By some accounts, up to 70 percent of websites use PHP in some capacity. | No denominator given up to | 'some accounts' (WSJ linked elsewhere in the story) | restates S-024 | 1a9a20537e47 |
| S-116 | 2026-10-22T15:14:06Z | Les Affaires capture | PHP: c’est la fondation de la majorité des sites web. PHP: it is the foundation of the majority of websites. | No denominator given the majority | none | restates | d70540e1f61d |
| S-117 | 2026-10-22T16:19:00Z | Computer Weekly capture | in the core PHP code underpinning almost three-quarters of the world’s websites | All websites almost | none | transforms | 8c5ef3c6921c |
| S-118 | 2026-10-22T17:41:37Z | RTL.de capture | Schätzungsweise 70 Prozent aller Websites basieren auf dem Skript. An estimated 70 percent of all websites are based on the script. | All websites an estimated | none | restates S-015 | a69da5f39287 |
| S-119 | 2026-10-22T17:52:24Z | LEBIGDATA.FR capture | Près de 70 % du Web utilise PHP : mais non, 70 % des sites ne sont pas automatiquement piratables Nearly 70% of the Web uses PHP: but no, 70% of sites are not automatically hackable | 'The Internet' or 'the web' nearly | none | restates | e2295f56852e |
| S-120 | 2026-10-22T17:52:24Z | LEBIGDATA.FR capture | D’après W3Techs, PHP équipe toujours près de 70 % des sites dont le langage serveur est identifiable. According to W3Techs, PHP still powers nearly 70% of sites whose server language is identifiable. | Websites whose language is known nearly | W3Techs links the measurement | measures | e2295f56852e |
| S-125 | 2026-10-23T03:02:01Z | nguoiquansat.vn capture | Lỗ hổng php2shell đe dọa 70% website toàn cầu php2shell vulnerability threatens 70% of websites worldwide | All websites none | none | transforms S-015 | 176d23d05dee |
| S-126 | 2026-10-23T05:00:00Z | TechTargetジャパン capture | サーバサイドプログラミング言語が判明しているWebサイトを対象に実施した調査（2026年10月時点）では、Webサイトの69.3％をPHPが支えている。 In a survey of websites whose server-side programming language is known (as of October 2026), PHP supports 69.3% of websites. | Websites whose language is known none | W3Techs | measures | 14c421632d95 |
| S-127 | 2026-10-23T06:30:00Z | Everyeye Tech capture | il 70% dei siti al mondo è stato a rischio per più di 10 anni! 70% of the world's sites have been at risk for more than 10 years! | All websites none | none | transforms S-015 | c12e14252ec4 |
| S-061 | 2026-10-21 | The PHP Foundation capture | releasing the patch early and thus risking 70% of the web just to make sure you get less risk is absolutely wild and irresponsible | 'The Internet' or 'the web' none | none (commenter Ok_Evidence_9745) | restates S-014 | a1be057adc1c |
| S-062 | 2026-10-21 | The PHP Foundation capture | PHP runs a large share of the web | 'The Internet' or 'the web' a large share | PHP Foundation (own text) | restates | a1be057adc1c |
| S-063 | 2026-10-21 | The PHP Foundation capture | releasing the patch early and thus risking 70% of the web just to make sure you get less risk is absolutely wild and irresponsible | 'The Internet' or 'the web' none | none (commenter Ok_Evidence_9745) | restates S-061 | b9f29cfdc1c0 |
| S-064 | 2026-10-21 | Canadian Centre for Cyber Security (CCCS) capture | PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | 'The Internet' or 'the web' none | Wiz (cited title) | restates S-014 | 9e7f44cc73e2 |
| S-065 | OpenAI / Wiz / Calif joint microsite (php2shell.com) capture | PHP powers approximately 70% of websites, including platforms such as WordPress, Drupal and Wikipedia's MediaWiki. | No denominator given approximately | none (joint OpenAI/Wiz/Calif microsite) | restates S-015 | b1e83b4f0feb | |
| S-066 | 2026-10-21 | Lorikeet Security capture | exposing an estimated 70% of the public web. | 'The Internet' or 'the web' an estimated | none | transforms S-014 | db7958824da2 |
| S-067 | 2026-10-21 | Lorikeet Security capture | According to web technology surveys, PHP still underpins approximately 70% to 75% of all web servers worldwide. | Servers or hosts approximately 70% to 75% | 'web technology surveys' (unnamed) | transforms | db7958824da2 |
| S-068 | 2026-10-21 | Reuters factbox, via Global Banking and Finance capture | PHP, a programming language that powers a large share of the internet. | 'The Internet' or 'the web' a large share | Reuters | restates S-019 | d562e28995b0 |
| S-069 | 2026-10-21 or 22 (date not in the text; the page refers to Wednesday 21 October) | CRN capture | “With 70 percent of the Internet affected, the impact of PHP2Shell cannot be overstated,” researchers at Google-owned Wiz wrote in a post. | 'The Internet' or 'the web' none | Wiz (linked post) | restates S-016 | 7e2214693ddd |
| S-121 | 2026-10-22 | The Hacker News (Ravie Lakshmanan) capture | "PHP is used by almost 70% of websites," Cloudflare said. | No denominator given almost | Cloudflare | restates S-013 | c1cb63141287 |
| S-122 | 2026-10-22 | The Hacker News (Ravie Lakshmanan) capture | With PHP powering a majority of the websites in the world, the vast attack surface | All websites a majority | Wiz (by hyperlink only) | restates S-015 | c1cb63141287 |
| S-123 | 2026-10-22 | JPCERT/CC (Japan) capture | PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | 'The Internet' or 'the web' none | Wiz (cited title) | restates S-014 | 1fea87241b30 |
| S-124 | Security.NL capture | En toch hangt ruim 70 procent van het internet aan elkaar van PHP oplossingen And yet over 70 percent of the internet is held together by PHP solutions | 'The Internet' or 'the web' over | none (anonymous reader comment) | restates S-014 | 95d1565c5959 |
What this does not show
- W3Techs does not publish what share of sites have a known server-side language, so its 69.3% cannot be turned into a share of all websites.
- The HTTP Archive shares are the desk's own division of two published counts (PHP origins over all origins, same date and client); the HTTP Archive does not publish the ratio.
- Every host count except the Censys query gist reaches the vault through a news outlet; no scanner's own publication is captured.
- The Internet Archive could not be reached from the desk's session; the history of wording rests on the vault's repeat captures, the pages' own modified dates and Wikipedia's revision history.
- The measurers' pages were fetched by the desk on 24 October and are not captured into a vault; they are shown with URL, time and sha256, and are not evidence of the story until captured (board 033, 043 and 222 ask the collectors for W3Techs).