# How much PHP is there, and where does '70%' come from?

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

About 69% of the websites whose server-side language W3Techs can identify, and falling: it was 80.6% in 2015. On every site the HTTP Archive crawls, PHP is detected on about half (48%). WordPress alone, which needs PHP, is on 39.6% of all w

# How much PHP is there, and where does '70%' come from?

How much of the web runs on PHP, by every measure that someone actually measures; and how did one of those measures become '70% of the Internet'? An investigation by the [fact-check desk](../../index.html), opened 2026-10-24 at the editor's request; as of 2026-10-24T01:50Z.

## The short answer

**About 69% of the websites whose server-side language W3Techs can identify, and falling: it was 80.6% in 2015. On every site the HTTP Archive crawls, PHP is detected on about half (48%). WordPress alone, which needs PHP, is on 39.6% of all websites. On the internet, the scanners count PHP on about 2 to 3 million hosts. No one measures a share of 'the Internet'. '70% of the Internet' is a website figure, restated in Wiz's own post, then copied.**

## The versions of the claim, graded

On the desk's spectrum of evidence, from A0 (nothing carries it) to A6 (the primary record carries it).
- **A6** Established●●●●●● ***PHP runs about 69-70% of the websites whose server-side language is known*** · Count · holdsW3Techs' own page, fetched on 24 October: 69.3% as of 23 October, on 'all the websites whose server-side programming language we know'. The measurer is the primary record of its own measurement. It is one measurer, and W3Techs does not publish what share of sites have a known language.
- **A1** Weak signal●○○○○○ ***PHP runs 70% of all websites*** · Count · holds in partNo measurer of all websites gives 70%. The one that counts every crawled site, the HTTP Archive, detects PHP on 48.3% of mobile origins (September 2026, the desk's ratio of two published counts); WordPress alone is 39.6% of all sites (W3Techs). 'Of all websites' drops W3Techs' qualifier; W3Techs' own PHP 8 page does the same. The truth is between about 40% and about 70%, depending on what the unknown-language sites run.
- **A0** Unsupported○○○○○○ ***70% of the Internet*** · Count · not shownNothing measures a share of 'the Internet'. Scanners count PHP on about 2 to 3 million internet-facing hosts (Censys, VulnCheck, Shodan), 5.1 million IP addresses (VirusTotal). The phrase first appears in Wiz's X post at 13:32 UTC on 21 October; the body of Wiz's own blog post says 'websites'. It is a website share restated, a change of denominator, not a measurement.
- **A2** Reported●●○○○○ ***75% of websites (Reuters, 'according to W3Techs')*** · Count · holds in partW3Techs' yearly table gives 75.2% on 1 January 2025, 72.4% on 1 January 2026 and 69.3% on 23 October 2026. Reuters' 75% matches the January 2025 figure, not the one W3Techs showed when Reuters wrote: an out-of-date number, correctly attributed.
- **A0** Unsupported○○○○○○ ***could take down 70% of the internet (Fortune)*** · Opinion · not shownFortune's headline and lede, in its own voice, with no source: a usage share became a share that could be taken down. Its only attributed 70% is an accurate quote of Wiz's conclusion. Nothing in the evidence measures what could be taken down.

## What the evidence shows
- The measurement exists, and it is W3Techs: 69.3% of the websites whose server-side programming language W3Techs knows, on 23 October 2026. Every outlet that names a measurer names W3Techs.
- It is falling, and has been for a decade: 80.6% in January 2015, 75.2% in January 2025, 72.4% in January 2026, 69.3% now. '70%' is already a rounding up.
- The bigger the site, the less PHP: 64.4% of the top million, 60.9% of the top 100,000, 58.7% of the top 1,000 (W3Techs, known-language sites).
- On all websites, the only measurer that counts every crawled site gives about half: the HTTP Archive detects PHP on 48.3% of mobile origins and 47.3% of desktop origins in September 2026, down from about 58% in January 2023.
- WordPress, which cannot run without PHP, is on 39.6% of all websites (W3Techs): a floor for PHP's share of all sites in that sample.
- Counted in sites rather than shares: BuiltWith 23.96 million live PHP sites, Wappalyzer about 22.7 million. Neither publishes a denominator.
- On the internet, scanners count hosts, not shares: about 2.6 million (Censys, VulnCheck), 1.9 million (Shodan), 5.1 million IP addresses (VirusTotal). Palo Alto's 22.6 million 'instances' (via Fortune) is not in Palo Alto's own advisory and is ten times every other count.
- In the evidence vault, 127 statements of PHP's share in 11 languages, from 94 sources: 39 against 'the Internet' or 'the web', 29 against all websites, 30 with W3Techs' known-language denominator, 23 with no denominator.
- '70% of the Internet' starts with Wiz: its X post at 13:32 UTC on 21 October, then its blog headline and conclusion. The same post's executive summary says 'powers 70% of all websites in the world'. The denominator changes inside the origin, which cites no measurement.
- 17 statements link a measurement; only one of the 39 'Internet' statements does (MediaNama puts a W3Techs link on the words '70% of the internet').
- Re-checked live on 24 October: 73 page records at 68 addresses; 64 unchanged, 4 reworded without a note, 3 blocked, 2 could not be checked, none corrected. Wiz has changed nothing. CNN rewrote its 70% lines twice and still says 'internet' in the headline.
- Outside the 70%: AWS rewrote 'PHP2Shell is now being broadly exploited in the wild' as 'now seeing broad exploitation attempts in the wild', without a note. This site quotes the first wording.

## How much PHP there is, by who measures it

Each measurer counts something different, so the measures are kept apart and never added together. The share charts use one axis, in percent; the counts are in a separate chart.
W3Techs: PHP, websites whose server-side language is knownHTTP Archive: PHP, all crawled origins (mobile)W3Techs: WordPress, all websitesThe points as a table
| Series | Date | Share |
|---|---|---|
| W3Techs, PHP, known-language sites | 2015-01-01 | 80.6% |
| W3Techs, PHP, known-language sites | 2016-01-01 | 80.0% |
| W3Techs, PHP, known-language sites | 2017-01-01 | 80.0% |
| W3Techs, PHP, known-language sites | 2018-01-01 | 80.2% |
| W3Techs, PHP, known-language sites | 2019-01-01 | 78.9% |
| W3Techs, PHP, known-language sites | 2020-01-01 | 78.9% |
| W3Techs, PHP, known-language sites | 2021-01-01 | 79.1% |
| W3Techs, PHP, known-language sites | 2022-01-01 | 78.1% |
| W3Techs, PHP, known-language sites | 2023-01-01 | 77.7% |
| W3Techs, PHP, known-language sites | 2024-01-01 | 76.7% |
| W3Techs, PHP, known-language sites | 2025-01-01 | 75.2% |
| W3Techs, PHP, known-language sites | 2026-01-01 | 72.4% |
| W3Techs, PHP, known-language sites | 2026-10-23 | 69.3% |
| HTTP Archive, PHP, all origins (mobile) | 2020-01-01 | 51.0% |
| HTTP Archive, PHP, all origins (mobile) | 2021-01-01 | 50.2% |
| HTTP Archive, PHP, all origins (mobile) | 2022-01-01 | 56.9% |
| HTTP Archive, PHP, all origins (mobile) | 2023-01-01 | 58.0% |
| HTTP Archive, PHP, all origins (mobile) | 2024-01-01 | 56.4% |
| HTTP Archive, PHP, all origins (mobile) | 2025-01-01 | 54.6% |
| HTTP Archive, PHP, all origins (mobile) | 2026-01-01 | 52.3% |
| HTTP Archive, PHP, all origins (mobile) | 2026-09-01 | 48.3% |
| W3Techs, WordPress, all sites | 2015-01-01 | 23.3% |
| W3Techs, WordPress, all sites | 2016-01-01 | 25.6% |
| W3Techs, WordPress, all sites | 2017-01-01 | 27.3% |
| W3Techs, WordPress, all sites | 2018-01-01 | 29.2% |
| W3Techs, WordPress, all sites | 2019-01-01 | 32.7% |
| W3Techs, WordPress, all sites | 2020-01-01 | 35.4% |
| W3Techs, WordPress, all sites | 2021-01-01 | 39.5% |
| W3Techs, WordPress, all sites | 2022-01-01 | 43.2% |
| W3Techs, WordPress, all sites | 2023-01-01 | 43.1% |
| W3Techs, WordPress, all sites | 2024-01-01 | 43.1% |
| W3Techs, WordPress, all sites | 2025-01-01 | 43.6% |
| W3Techs, WordPress, all sites | 2026-01-01 | 43.0% |
| W3Techs, WordPress, all sites | 2026-10-24 | 39.6% |

### Hosts on the internet counted running PHP

Censys's 54.9 million 'web properties' counts names, not machines, and reaches the vault third-hand; it is in the table below, not the chart. Palo Alto's 22.6 million 'instances' is not in Palo Alto's own advisory.

### Websites

| Measure | Value | Over what, and how | As of | Source |
|---|---|---|---|---|
| **W3Techs (Q-Success)**share of websites whose server-side programming language W3Techs knows that use PHP | **69.3%** | all the websites whose server-side programming language we know (within W3Techs' relevant-web sample)Denominator is sites with a KNOWN server-side language, not all websites. W3Techs' free pages do not publish what fraction of sites have a known language (no 'unknown/none' row for this category, unlike CMS). Multiple languages per site allowed. Same page dated 24 Oct 2026 on overview/programming_language/all. | 2026-10-23 | [w3techs.com/technologies/details/pl-php](https://w3techs.com/technologies/details/pl-php)fetched by the desk 2026-10-24T01:31:13Z, sha256 `f49b114f2c6055e2`*PHP is used by 69.3% of all the websites whose server-side programming language we know.* |
| **W3Techs (Q-Success)**monthly trend of the same PHP share (known-language sites) | **69.3%** | all the websites whose server-side programming language we knowFalls about 0.3 points a month: 73.4% on 1 Oct 2025 to 69.3% on 23 Oct 2026. JavaScript (server-side) rose from 5.0% to 8.2% over the same period. | 2026-10-23 | [w3techs.com/technologies/history_overview/progra](https://w3techs.com/technologies/history_overview/programming_language)fetched by the desk 2026-10-24T01:32:22Z, sha256 `aea4e6acf2397713`*This report shows the historical trends in the usage of the top server-side programming languages since October 2025.* |
| **W3Techs (Q-Success)**PHP share among known-language sites, by traffic rank band | **64.4%** | websites whose server-side programming language we know and that rank in the top 1,000,000 (CrUX plus customised Tranco ranking)Value is top 1M; top 100k 60.9%, top 10k 59.4%, top 1k 58.7%. PHP share falls as traffic rises. | 2026-10-24 | [w3techs.com/technologies/breakdown/pl-php/rankin](https://w3techs.com/technologies/breakdown/pl-php/ranking)fetched by the desk 2026-10-24T01:37:59Z, sha256 `c75051a6d55f368c`*Overall 69.3% top 1,000,000 64.4% top 100,000 60.9% top 10,000 59.4% top 1,000 58.7%* |
| **BuiltWith**count of live websites BuiltWith detects using PHP | **23,961,854** | BuiltWith's index of websites ('live websites'); also 80,459,242 that used PHP historicallyAbsolute count, no denominator given on the page. History is BuiltWith's own chart series 'Entire Internet' (first point per year plus latest, 2026-08-22). Series peak 30,546,471 on 2020-10-03 (top 1m peak 547,327 same date); last chart point dated 2026-08-22. Bytes were gzip; excerpt from decoded copy. | 2026-08-22 | [trends.builtwith.com/framework/PHP](https://trends.builtwith.com/framework/PHP)fetched by the desk 2026-10-24T01:31:28Z, sha256 `467433b45a8db4be`*We know of 23,961,854 live websites using PHP and an additional 80,459,242 sites that used PHP historically* |
| **BuiltWith**count of top-1-million sites (BuiltWith traffic ranking) using PHP | **196,288** | BuiltWith's top 1m sitesAbout 19.6% of the top 1M, 13.4% of the top 100k, 13.6% of top 10k, 13.4% of top 1k (our division by the band size). Far below W3Techs' known-language shares: BuiltWith requires a positive PHP signal, W3Techs divides by known-language sites only. | 2026-08-22 | [trends.builtwith.com/framework/PHP](https://trends.builtwith.com/framework/PHP)fetched by the desk 2026-10-24T01:31:28Z, sha256 `467433b45a8db4be`*Traffic Top 1m 196,288 Top 100k 13,440 Top 10k 1,362 Top 1000 134* |
| **Wappalyzer**count of websites Wappalyzer tracks using PHP | **22,700,000** | websites in Wappalyzer's datasetRounded count, no denominator published on the page. | 2026-10-24 (retrieved; page gives no date) | [wappalyzer.com/technologies/programming-language](https://www.wappalyzer.com/technologies/programming-languages/php/)fetched by the desk 2026-10-24T01:31:28Z, sha256 `c96eba601b04e734`*Wappalyzer tracks about 22,700,000 websites using PHP.* |
| **HTTP Archive (Tech Report API, Wappalyzer detection)**count of origins in the HTTP Archive mobile crawl where PHP is detected | **4,221,648** | origins in the HTTP Archive crawl (CrUX-derived list), mobile client; ALL ranks, ALL geosDesktop 2,606,557. bq/BigQuery not usable (no credentials) so the published Tech Report API at cdn.httparchive.org/v1 (the endpoint httparchive.org's own techreport page calls) was used. | 2026-09-01 | [cdn.httparchive.org/v1/adoption?technology=PHP&g](https://cdn.httparchive.org/v1/adoption?technology=PHP&geo=ALL&rank=ALL)fetched by the desk 2026-10-24T01:35:57Z, sha256 `2013e7d1b47ecbd2`*{"date":"2026-09-01","adoption":{"desktop":2606557,"mobile":4221648},"technology":"PHP"}* |
| **HTTP Archive (Tech Report API, Wappalyzer detection)**share of all crawled origins where PHP is detected (mobile), computed from two published counts | **48.3%** | all origins in the HTTP Archive mobile crawl (8,739,300 in Sept 2026)Denominator is ALL origins, including those where no language is detectable, which is why it is lower than W3Techs. Desktop share history: 2020-01-01 50.9, 2021-01-01 50.7, 2022-01-01 56.3, 2023-01-01 55.9, 2024-01-01 54.9, 2025-01-01 53.3, 2026-01-01 50.5, 2026-09-01 47.3. Numerator excerpt is in httparchive-php-origins-mobile. | 2026-09-01 | [cdn.httparchive.org/v1/adoption?technology=ALL&g](https://cdn.httparchive.org/v1/adoption?technology=ALL&geo=ALL&rank=ALL)fetched by the desk 2026-10-24T01:35:58Z, sha256 `2241b8e38794dec3`*{"date":"2026-09-01","adoption":{"desktop":5515143,"mobile":8739300},"technology":"ALL"}* |

### Applications built on PHP

| Measure | Value | Over what, and how | As of | Source |
|---|---|---|---|---|
| **W3Techs (Q-Success)**share of ALL websites (W3Techs sample) using WordPress (a PHP application) | **39.6%** | all websites in W3Techs' sample (CMS report includes a 'None' row)Unlike the PHP language figure, this IS a share of all websites. Peaked at 43.6% on 1 Jan 2025 in the yearly trend; 'None' (no monitored CMS) rose from 28.6% (1 Jan 2026) to 32.1% (24 Oct 2026). WordPress alone implies PHP, so 39.6% of all sites is a floor-type figure for PHP on all sites in this sample. | 2026-10-24 | [w3techs.com/technologies/details/cm-wordpress](https://w3techs.com/technologies/details/cm-wordpress)fetched by the desk 2026-10-24T01:32:12Z, sha256 `c7c819ccd71cea94`*WordPress is used by 58.3% of all the websites whose content management system we know. This is 39.6% of all websites .* |
| **W3Techs (Q-Success)**share of ALL websites using Joomla / Drupal (PHP CMSs) | **1.1%** | all websites in W3Techs' sampleValue and history are Joomla (share of all sites). Drupal 0.6% of all sites now; Drupal yearly history (all sites) from the same trend page: 2015 2.0%, 2016 2.1%, 2017 2.2%, 2018 2.3%, 2019 1.9%, 2020 1.7%, 2021 1.5%, 2022 1.3%, 2023 1.2%, 2024 1.1%, 2025 0.9%, 2026 0.8%, 2026-10-24 0.6%. Other PHP CMSs in the list: PrestaShop 0.5%, Bitrix 0.4%, TYPO3 0.3%, OpenCart 0.3%, MODx, phpBB, Moodle 0.1% each. | 2026-10-24 | [w3techs.com/technologies/overview/content_manage](https://w3techs.com/technologies/overview/content_management)fetched by the desk 2026-10-24T01:31:26Z, sha256 `b363d4408a378f86`*Joomla 1.1% 1.6% Tilda 0.8% 1.2% Webflow 0.8% 1.2% Duda 0.7% 1.1% Drupal 0.6% 0.9%* |
| **HTTP Archive (Tech Report API, Wappalyzer detection)**share of all crawled mobile origins running WordPress, computed from published counts | **31.1%** | all origins in the HTTP Archive mobile crawlComparable with W3Techs' 39.6%-of-all-sites WordPress figure. | 2026-09-01 | [cdn.httparchive.org/v1/adoption?technology=WordP](https://cdn.httparchive.org/v1/adoption?technology=WordPress&geo=ALL&rank=ALL)fetched by the desk 2026-10-24T01:35:58Z, sha256 `7964a028052a0571`*{"date":"2026-09-01","adoption":{"desktop":1626771,"mobile":2714694},"technology":"WordPress"}* |
| **HTTP Archive Web Almanac 2025 (CMS chapter)**WordPress share of all websites (mobile) in the 2025 Almanac crawl | **35%** | all websites in the HTTP Archive 2025 crawl, mobile2022-2024 points are from the 2024 chapter (webalmanac-2024-cms.html): 'WordPress was used on 35.1% in 2022, 34.9% in 2023, and 35.6% in 2024'. The Almanac chapters do not give a PHP-language share. | 2025 (Almanac edition) | [almanac.httparchive.org/en/2025/cms](https://almanac.httparchive.org/en/2025/cms)fetched by the desk 2026-10-24T01:36:11Z, sha256 `180e877aeccff347`*peaking at 35.0% for all websites.* |

### PHP versions

| Measure | Value | Over what, and how | As of | Source |
|---|---|---|---|---|
| **W3Techs (Q-Success)**share of PHP websites on PHP major version 8 | **65.3%** | all the websites who use PHP (and whose version W3Techs detects)Expressed as share of known-language sites: v8 45.3%, v7 18.6%, v5 5.3%. Version is only known where sites expose it (e.g. X-Powered-By); W3Techs does not state the share of PHP sites with a known version. | 2026-10-23 | [w3techs.com/technologies/details/pl-php](https://w3techs.com/technologies/details/pl-php)fetched by the desk 2026-10-24T01:31:13Z, sha256 `f49b114f2c6055e2`*Version 8 is used by 65.3% of all the websites who use PHP. Version 8 65.3% Version 7 26.9% Version 5 7.7% Version 4 0.1%* |
| **W3Techs (Q-Success)**share of PHP websites on PHP major version 7 | **26.9%** | all the websites who use PHPWithin v7: 7.4 73.4%, 7.3 10.5%, 7.2 8.4%, 7.0 4.0%, 7.1 3.7%. The excerpt is the 7.x subversion split; the 26.9% top-line is in the w3techs-php-v8-share excerpt. All v7 is end-of-life. | 2026-10-23 | [w3techs.com/technologies/details/pl-php/7](https://w3techs.com/technologies/details/pl-php/7)fetched by the desk 2026-10-24T01:32:43Z, sha256 `95b2d636702df6d0`*Version 7.4 is used by 73.4% of all the websites who use PHP version 7.* |
| **W3Techs (Q-Success)**share of PHP websites on PHP major version 5 | **7.7%** | all the websites who use PHP7.7% of PHP sites = 5.3% of known-language sites. Within v5: 5.6 54.9%, 5.3 15.4%, 5.4 14.7%. | 2026-10-23 | [w3techs.com/technologies/details/pl-php/5](https://w3techs.com/technologies/details/pl-php/5)fetched by the desk 2026-10-24T01:32:43Z, sha256 `a2cd9ba5f26b6db6`*PHP version 5 is used by 5.3% of all the websites whose server-side programming language we know.* |
| **W3Techs (Q-Success)**split of PHP 8 sites by minor version (8.0/8.1 are end-of-life) | **20.9%** | all the websites who use PHP version 8value = 8.0 + 8.1 = 20.9% of PHP-8 sites (our sum). Derived: supported 8.2-8.5 = 79.1% of v8 = about 51.7% of PHP sites; so roughly 48% of version-detected PHP sites are on EoL branches (our arithmetic, not W3Techs'). | 2026-10-23 | [w3techs.com/technologies/details/pl-php/8](https://w3techs.com/technologies/details/pl-php/8)fetched by the desk 2026-10-24T01:31:54Z, sha256 `2e4782e518ceee75`*Version 8.3 34.9% Version 8.2 27.6% Version 8.1 15.1% Version 8.4 12.1% Version 8.0 5.8% Version 8.5 4.5%* |
| **JetBrains State of PHP 2025**share of surveyed PHP developers using PHP 8.x | **89%** | PHP developers in the JetBrains Developer Ecosystem survey 2025Developer self-report, skewed to JetBrains users per its own disclaimer; not site counts. | 2025 | [blog.jetbrains.com/phpstorm/2025/10/state-of-php](https://blog.jetbrains.com/phpstorm/2025/10/state-of-php-2025/)fetched by the desk 2026-10-24T01:36:59Z, sha256 `7720d77ce3d68761`*PHP 8.x dominates with 89% usage, while PHP 7.x has dropped to 33%. Legacy versions (5.6 and earlier) are now down to 8%* |

### Hosts and servers on the internet

| Measure | Value | Over what, and how | As of | Source |
|---|---|---|---|---|
| **Censys (query by Silas Cutler)**internet hosts whose service software product is PHP | **2,574,043** | hosts in Censys platform indexPrimary: the researcher's own published query result. Hosts (IPs), not websites. | 2026-10-22 (capture date; query date not stated) | [gist-silascutler-censys-query](../../../sources/gist-silascutler-censys-query/index.html)capture sha256 `5cea858eacc35a20`*For all PHP: host.services.software.product: "PHP" ( 2,574,043 results)* |
| **Censys (via SecurityWeek)**internet-facing hosts running PHP; with identifiable version; unpatched | **2,580,000** | internet-facing hosts seen by Censys on 2026-10-21Same article: approx. 1.57 million not patched; 'nearly 3 million' hosts as of 22 Oct. Second-hand (news). | 2026-10-21 | [securityweek-exploitation-days-before](../../../sources/securityweek-exploitation-days-before/index.html)capture sha256 `b922b47f8fab0fa8`*Out of 2.58 million internet-facing hosts seen on October 21, roughly 1.58 million were reporting identifiable PHP versions* |
| **Censys (via KrebsOnSecurity, via bitpage.de)**web properties serving PHP | **54,900,000** | Censys web-property indexThird-hand; Krebs article not in the vault. Web properties (names) not hosts. Same German page later cites Censys '34,4 Millionen verwundbare PHP-Dienste'. Born (borncity) reports an unquoted Censys 'php' search giving 7 million hosts and 59 million software products. | 2026-10 (not stated) | [bitpage-php2shell-php-sicherheitsluecke-webseite](../../../sources/bitpage-php2shell-php-sicherheitsluecke-webseite/index.html)capture sha256 `50d84bde38c55c17`*Censys zählt laut KrebsOnSecurity 2,58 Millionen direkt aus dem Internet erreichbare Hosts mit PHP und 54,9 Millionen Web-Properties, die PHP ausliefern.* |
| **VulnCheck (via The Hacker News)**internet-facing hosts with PHP identified | **2,608,039** | internet-facing hosts in VulnCheck's scan dataSame text: about 400,000 on 7.4/8.0/8.1 and 403,000 on supported 8.2-8.5. Second-hand. | 2026-10-21/22 | [thehackernews-php2shell-4days](../../../sources/thehackernews-php2shell-4days/index.html)capture sha256 `c1cb63141287484c`*VulnCheck's analysis has identified PHP on 2,608,039 internet-facing hosts, out of which over 700,000 hosts run PHP 3.x through 7.3.* |
| **VirusTotal (via SecurityWeek)**IP addresses running PHP; with version announced | **5,100,000** | IP addresses seen by VirusTotalOf 1.1M with a version: approx. 272,000 supported, approx. 758,000 EoL (5.4-8.1). About four in five hide the version. Also in recordedfuture-php2shell and bleepingcomputer-php2shell captures. Second-hand. | 2026-10-21 | [securityweek-exploitation-days-before](../../../sources/securityweek-exploitation-days-before/index.html)capture sha256 `b922b47f8fab0fa8`*VirusTotal says it sees roughly 5.1 million IP addresses running PHP, but only 1.1 million of them announce a version* |
| **Mallory (Shodan banner counts, via The Hacker News)**hosts whose HTTP banner reports PHP 8.1 or older | **884,000** | internet-facing hosts in Shodan reporting any PHP version (approx. 1.5 million)59% of the roughly 1.5 million version-reporting hosts. cybelangel capture gives exact 883,717. | 2026-10-20 | [thehackernews-php2shell-unpatched-alert](../../../sources/thehackernews-php2shell-unpatched-alert/index.html)capture sha256 `33ba8292e26406d7`*Security company Mallory counted about 884,000 internet-facing hosts whose HTTP banner reported a PHP version of 8.1 or older* |
| **Shodan (search by Henk Poley, via Tenable)**internet-exposed hosts running PHP (Shodan search) | **1,900,000** | Shodan indexDirect Shodan fetch was blocked (Cloudflare challenge). Same capture: Silas Cutler's rough estimate of over 1.3 million potentially vulnerable hosts. | 2026-10-21/22 | [tenable-php2shell-faq](../../../sources/tenable-php2shell-faq/index.html)capture sha256 `10d98694b9c0243e`*A Shodan search by Henk Poley counts over 1.9 million internet-exposed hosts running PHP.* |
| **Palo Alto Networks (as reported by Fortune and others)**'potentially vulnerable instances' / 'internet-exposed servers' (definition unclear) | **22,600,000** | not statedUNVERIFIED and an outlier: about 10x every host count above. Vault curator marks claim scale-22m-paloalto 'unverified': Palo Alto's own advisory (paloalto-psirt-cve-2026-109618) gives no such figure. Claim cur3-22m-servers (TechTarget Japan) 'basis not stated'. Likely counts instances/sites, not hosts. Do not use as a host count without the primary. | 2026-10-22/23 | [fortune-ai-tools-php-vulnerability](../../../sources/fortune-ai-tools-php-vulnerability/index.html)capture sha256 `cdcba1b8c212b9e8`*An initial analysis by cybersecurity firm Palo Alto Networks identified 22.6 million potentially vulnerable instances.* |

### Packages

| Measure | Value | Over what, and how | As of | Source |
|---|---|---|---|---|
| **Packagist.org**packages registered on Packagist (the Composer PHP package repository) | **475,515** | Packagist.org registrystatistics.json fetched seconds later gave packages 475503, versions 5967561, downloads 207859011119 (live counters). | 2026-10-24 | [packagist.org/statistics](https://packagist.org/statistics)fetched by the desk 2026-10-24T01:31:28Z, sha256 `c81dcafd59845c51`*Packages registered 475 515 Versions available 5 972 250 Packages installed (since 2012-04-13) 207 858 803 613* |
| **Packagist.org**cumulative package installs via Composer since 2012-04-13 | **207,858,803,613** | Composer installs served by Packagist.orgInstalls, not users or sites. Packagist php-statistics page (installs by PHP minor version) is chart-only; numbers not in the static bytes. | 2026-10-24 | [packagist.org/statistics](https://packagist.org/statistics)fetched by the desk 2026-10-24T01:31:28Z, sha256 `c81dcafd59845c51`*Packages installed (since 2012-04-13) 207 858 803 613* |

### Developers

| Measure | Value | Over what, and how | As of | Source |
|---|---|---|---|---|
| **Stack Overflow Developer Survey 2025**share of all respondents who worked with PHP in the past year | **18.9%** | 2025 survey respondents answering the language question (All Respondents)Excerpt anchors the 'All Respondents' list; the same list continues 'C++ 23.5% PowerShell 23.2% C 22% PHP 18.9% Go 16.4%'.Professional developers 19.1%. 12th language. The 2026 survey page lists only the top 10 languages (PHP not among them); PHP figure for 2026 not in the fetched bytes. | 2025 | [survey.stackoverflow.co/2025/technology](https://survey.stackoverflow.co/2025/technology)fetched by the desk 2026-10-24T01:36:27Z, sha256 `721a084a2139830b`*All Respondents JavaScript 66% HTML/CSS 61.9% SQL 58.6% Python 57.9%* |
| **TIOBE Index**PHP rating in the TIOBE index (search-engine popularity) | **1.26%** | TIOBE search-engine hit modelRank 12 in October 2026, 14 a year earlier. Not a usage measure. Page heading 'TIOBE Index for October 2026'. | 2026-10 | [tiobe.com/tiobe-index/](https://www.tiobe.com/tiobe-index/)fetched by the desk 2026-10-24T01:36:28Z, sha256 `d55f43879550643a`*12 14 PHP 1.26% -0.12%* |

## Every statement of the share, by time and wording
Websites whose language is knownAll websites'The Internet' or 'the web'Servers or hostsWeb applicationsNo denominator given
Each dot is one statement in the evidence vault, placed at its publication time where the page gives one (otherwise its first capture; each statement says which). A ringed dot is the family's origin; the dashed line is Wiz's X post at 13:32 UTC on 21 October. 14 statements fall outside 21 to 23 October and are in the table. Hover a dot for its words; click it for its row.

## What the statements say they measure

| Family | Statements | Measures | Origin |
|---|---|---|---|
| **70% of the Internet / the web (Wiz headline and X post)** | 28 | 'The Internet' or 'the web' | [S-008](#S-008) |
| **70% of (all) websites (in the world) (Wiz blog executive summary)** | 32 | All websites | [S-015](#S-015) |
| **an estimated 70% of websites (OpenAI)** | 4 | No denominator given | [S-017](#S-017) |
| **almost 70% of websites (Cloudflare, linked to W3Techs)** | 3 | No denominator given | [S-013](#S-013) |
| **69.3% / about 70% of websites whose server-side language is known (W3Techs measurement)** | 25 | Websites whose language is known | [S-004](#S-004) |
| **roughly 75% of websites whose programming language can be identified, per W3Techs (Reuters)** | 3 | Websites whose language is known | [S-002](#S-002) |
| **"roughly 70%" of the internet, quoted and credited to Wiz (BBC)** | 4 | 'The Internet' or 'the web' | [S-077](#S-077) |
| **three quarters / two thirds rounding** | 5 | All websites | [S-001](#S-001) |
| **inflated ranges and ceilings (70-80%, 75-80%, up to 80%)** | 4 | No denominator given | [S-005](#S-005) |
| **websites and web applications** | 3 | Web applications | [S-007](#S-007) |
| **servers** | 2 | Servers or hosts | [S-025](#S-025) |
| **national segments (.pt, .ma)** | 2 | Websites whose language is known | [S-090](#S-090) |
| **qualitative: a large share / most / the majority (no number)** | 12 | No denominator given | [S-019](#S-019) |

## The lineage, as a graph

Start at Wiz's X post and walk: which statements belong to which wording, which restate or reword which, and which credit the measurement.

The graph needs JavaScript. The same lineage, by family:
- [70% of the Internet / the web (Wiz headline and X post)](#S-008): 28 statements
- [70% of (all) websites (in the world) (Wiz blog executive summary)](#S-015): 32 statements
- [an estimated 70% of websites (OpenAI)](#S-017): 4 statements
- [almost 70% of websites (Cloudflare, linked to W3Techs)](#S-013): 3 statements
- [69.3% / about 70% of websites whose server-side language is known (W3Techs measurement)](#S-004): 25 statements
- [roughly 75% of websites whose programming language can be identified, per W3Techs (Reuters)](#S-002): 3 statements
- ["roughly 70%" of the internet, quoted and credited to Wiz (BBC)](#S-077): 4 statements
- [three quarters / two thirds rounding](#S-001): 5 statements
- [inflated ranges and ceilings (70-80%, 75-80%, up to 80%)](#S-005): 4 statements
- [websites and web applications](#S-007): 3 statements
- [servers](#S-025): 2 statements
- [national segments (.pt, .ma)](#S-090): 2 statements
- [qualitative: a large share / most / the majority (no number)](#S-019): 12 statements

## Fortune: 'could take down 70% of the internet'

The editor asked for this one (UF-005.1, board 195). Fortune's article by Emily Forlini, Senior AI Reporter, 2026-10-21T18:48:38Z (datePublished); modified 2026-10-22T14:56:06Z; captured 2026-10-23T01:20Z, as captured in the vault:
- **h1:** *AI tools discovered the PHP vulnerability that could take down 70% of the internet. Now, the race is on to patch it before AI-powered hackers attack*
- **html title:** *AI helped discover the PHP vulnerability that could take down 70% of the internet | Fortune*
- **lede:** *Today, the defenders are hoping they got a leg up in identifying a critical issue that stands to take down 70% of the internet if left unaddressed.*
- **quote:** *“With 70% of the internet affected, the impact of php2shell cannot be overstated,” Wiz said in a blog post announcing its findings.*
- **other share sentences:** *Most web pages run using an open-source programming language called PHP.* *Among the most well known sites that run on PHP is WordPress, which powers roughly 40% of all websites, according to Reuters.*

**What it credits.** The 70% figure is attributed only through the quote of Wiz's conclusion, linked to the Wiz blog. The headline and lede state it in Fortune's own voice with no source. Fortune's one W3Techs link (anchor 'according to') supports a list of example PHP sites (Microsoft.com, Wikipedia.org, Archive.org, TheGuardian.com, Baidu.com), not the share; the WordPress 40% is credited to Reuters.

**Against Wiz.** Fortune quotes the Wiz conclusion accurately (only 'Internet' to 'internet' and 'PHP2Shell' to 'php2shell'). But its headline and lede change Wiz's verb: Wiz wrote 'affecting 70% of the Internet' and 'With 70% of the Internet affected'; Fortune wrote 'could take down 70% of the internet' and 'stands to take down 70% of the internet if left unaddressed'. Usage share becomes the share that could be knocked offline. Fortune does not use Wiz's other wording, 'powers 70% of all websites in the world'.

**Against W3Techs.** W3Techs measures PHP on 69.3% (21 Oct, as cited by Tenable, Bitpage, AI4Business, Critic Arad, BDM, Marketing4eCommerce, TechTarget Japan) of websites whose server-side programming language it can identify: a usage share among sites with a detectable language, not of all websites, not of 'the internet', and not of exposure. Fortune links W3Techs but not for this figure, keeps no qualifier, and turns the denominator into 'the internet' and the measure into what could be 'taken down'. Its body does carry a softer qualitative line ('Most web pages run using ... PHP').

**Between its own versions.** H1 'AI tools discovered...' versus /og:title 'AI helped discover...': the AI claim is softened between headline versions; the 70% wording stays.

Statements S-048, S-049, S-050, S-051; graded above as *could take down 70% of the internet*.

## Did anyone correct it?

Every page in the vault that uses the figure, and every page the corrections liaison has written to, was fetched again on 24 October and compared with its capture: 64 unchanged, 4 reworded, 3 blocked, 2 could not be checked, and none corrected. Every change the desk found, the figure's and others on the same pages:

| Who | What changed | Before | After |
|---|---|---|---|
| CNN Business | headline | *Global websites shut down after AI found a critical flaw affecting 70% of the internet*2026-10-22T08:09:52Z (vault capture) | *Websites shut down globally after AI finds a critical flaw affecting 70% of the internet*2026-10-22T11:26:16Z (vault capture of the -intl URL; dateModified 2026-10-22T11:06:26Z) |
| CNN Business | headline | *Websites shut down globally after AI finds a critical flaw affecting 70% of the internet*2026-10-22T11:26:16Z (vault capture) | *Websites shut down globally after AI finds cybersecurity flaw affecting 70% of the internet*page says Updated Oct 22, 2026, 2:26 PM ET (dateModified 2026-10-22T18:26:13Z); fetched 2026-10-24 |
| CNN Business | body | *a programming language that powers 70% of all websites in the world, including WordPress and Drupal*2026-10-22T11:26:16Z (vault capture) | *a programming language that powers 70% of the world’s websites*Updated Oct 22, 2026, 2:26 PM ET; fetched 2026-10-24 |
| CNN Business | body | *after artificial intelligence helped discover and address critical bugs that could affect 70% of the internet*2026-10-22T08:09:52Z (vault capture, original URL) | *Governments and companies around the world are racing to fix vulnerabilities revealed by artificial intelligence that could affect 70% of the world’s websites*Updated Oct 22, 2026, 2:26 PM ET; fetched 2026-10-24 |
| Wikipedia | body | *that allow [[Arbitrary code execution\|remote code execution]] (RCE). Their existence was publicly announced on 20 October 2026.*revision 1381578822, 2026-10-23T13:11Z | *with the two vulnerabilities estimated to affect nearly 70% of the commercial world wide web.*revision 1381581724, 2026-10-23T13:41:34Z (editor Masem); still in 1381672424, 2026-10-24T01:37Z |
| AWS Security Blog | body | *PHP2Shell is now being broadly exploited in the wild.*2026-10-22T11:17:55Z (vault capture; article:modified_time 2026-10-21T21:36:56-07:00) | *PHP2Shell is now seeing broad exploitation attempts in the wild.*article:modified_time 2026-10-22T14:25:03-07:00; fetched 2026-10-24 |
| BBC News | body | *with cyber-security firm Wiz estimating that "roughly 70%" of the internet is affected, though the BBC is unable to independently verify that figure*entry published 2026-10-22T06:15:41Z (still on ?page=3, fetched 2026-10-24T01:34:20Z) | *According to cyber-security firm Wiz, which helped uncover the critical PHP vulnerabilities surfaced this week, PHP powers 70% of the world’s websites*later entries 13:54 and 16:27 UTC, 22 Oct (live page, fetched 2026-10-24) |
| 20 minutes (20min.ch) | headline | *Panne mondiale des sites web: la Suisse romande touchée*2026-10-22T08:14:21Z (vault capture) | *Panne mondiale: la Suisse romande fortement impactée*2026-10-22T18:16:08Z (vault capture) and live 2026-10-24 |
| The Record | correction-note | *not there*vault capture | *Correction: A previous version of this article used an incorrect pronoun for Detectify researcher Joviane Jardim.*fetched 2026-10-24 |

## All 127 statements
The full table
| # | When (UTC) | Who | The words | Measures | Credits | Role | sha256 |
|---|---|---|---|---|---|---|---|
| S-001 | 2025-09-03T00:40:32Z | [php[architect]](https://www.phparch.com/2025/09/php-security-in-2025-lessons-from-the-core-security-audit/) [capture](../../../sources/phparch-php-security-2025-audit/index.html) | *powers nearly three-quarters of all websites on the internet* | All websitesnearly | none | restates | 95189f8e2e19 |
| S-002 | 2026-10-21T07:46:45Z | [rte.ie](https://www.rte.ie/news/world/2026/1021/1596231-eu-cybersecurity/) [capture](../../../sources/rte-reuters-websites-go-dark/index.html) | *PHP runs roughly 75% of websites whose programming language can be identified, according to web technology tracker W3Techs* | Websites whose language is knownroughly | W3Techs | origin | 99bb92662561 |
| S-003 | 2026-10-21T07:46:45Z | [rte.ie](https://www.rte.ie/news/world/2026/1021/1596231-eu-cybersecurity/) [capture](../../../sources/rte-reuters-websites-go-dark/index.html) | *He said the popular programme is used by 70% of websites worldwide.* | All websitesnone | Brian Honan (cybersecurity expert, RTE interview) | restates | 99bb92662561 |
| S-004 | 2026-10-21T09:01:24Z | [Tenable](https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote) [capture](../../../sources/tenable-php2shell-faq/index.html) | *According to W3Techs, PHP is used by 69.3% of websites whose server-side language is known.* | Websites whose language is knownnone | W3Techslinks the measurement | measures | 10d98694b9c0 |
| S-005 | 2026-10-21T10:38:58Z | [SOCRadar](https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/) [capture](../../../sources/socradar-blog-php2shell/index.html) | *The exposure is large. PHP powers up to 80% of websites.* | No denominator givenup to | none | transforms | 88edcdf127e0 |
| S-006 | 2026-10-21T11:41:07Z | [cyberkendra.com](https://www.cyberkendra.com/2026/10/php2shell-cve-2026-109618-cve-2026-109619.html) [capture](../../../sources/cyberkendra-2026-10-php2shell-cve-2026-109618-cve-20/index.html) | *PHP runs on about 70% of websites whose server-side language is known, according to W3Techs.* | Websites whose language is knownabout | W3Techslinks the measurement | measures | c604df6084ae |
| S-007 | 2026-10-21T12:31:18Z | [www.clickx.be](https://www.clickx.be/fr/actualites/200877/des-failles-php-critiques-menacent-les-sites-web-du-monde-entier-dpg-media-et-les-pouvoirs-publics-mettent-leurs-sites-hors-ligne/) [capture](../../../sources/clickx-fr-actualites-200877-des-failles-php-critiques-menace/index.html) | *On estime qu’environ 70 % des sites web ou des applications web fonctionnent sous PHP.*It is estimated that around 70% of websites or web applications run on PHP. | Web applicationsaround | none ('on estime') | transforms | f1876f8dd430 |
| S-008 | 2026-10-21T13:32:25Z | [Wiz (@wiz_io)](https://x.com/wiz_io/status/2112899813264277528) [capture](../../../sources/x-wiz-io-php2shell/index.html) | *Research uncovers #PHP2SHELL, a decade-old PHP Core vulnerability reaching CVSS 9.2 severity impacting 70% of the Internet.* | 'The Internet' or 'the web'none | Wiz (own claim) | origin | 6c1797766281 |
| S-009 | 2026-10-21T13:40:02Z | [CyberScoop](https://cyberscoop.com/php-emergency-patches-php2shell-vulnerabilities/) [capture](../../../sources/cyberscoop-php-emergency-patches-php2shell-vulnerab/index.html) | *PHP runs between 70-80% of websites whose server-side language is known, according to market research* | Websites whose language is knownbetween 70-80% | 'market research' (unnamed) | transforms [S-004](#S-004) | b47b3a5031e3 |
| S-010 | 2026-10-21T13:47:21Z | [Imperva Threat Research (Nadav Avital, Bar Menachem)](https://www.imperva.com/blog/php2shell-vulnerability-updates/) [capture](../../../sources/imperva-blog-php2shell/index.html) | *With PHP used by over 69% of websites whose server-side programming language is known, the potential exposure is substantial.* | Websites whose language is knownover | none (W3Techs wording, no link) | restates [S-004](#S-004) | 3da873bdb212 |
| S-011 | 2026-10-21T13:48:03Z | [globalnews.ca](https://globalnews.ca/news/12110881/government-sites-go-dark-vuln-in-code/) [capture](../../../sources/globalnews-ottawa-sites/index.html) | *a serious vulnerability in the code that underpins roughly 70 per cent of the world’s websites.* | All websitesroughly | none | restates [S-015](#S-015) | 87d2ae5079c3 |
| S-012 | 2026-10-21T13:53:36Z | [Fastly](https://www.fastly.com/blog/fastlys-proactive-protection-critical-php-rce-cve-2026-109618) [capture](../../../sources/fastly-blog-php2shell/index.html) | *PHP – the runtime behind most of the web's content management systems, ecommerce platforms, and publishing infrastructure* | Web applicationsmost | none | restates | bacf27615fe1 |
| S-013 | 2026-10-21T13:56:45Z | [Cloudflare](https://blog.cloudflare.com/php-vulnerabilities-waf-protection/) [capture](../../../sources/cloudflare-blog-php2shell-waf/index.html) | *PHP is used by almost 70% of websites.* | No denominator givenalmost | W3Techs (by hyperlink only)links the measurement | measures | 302408765abf |
| S-014 | 2026-10-21T13:59:59Z | [Wiz (Wiz Research)](https://www.wiz.io/blog/php2shell-php-rce) [capture](../../../sources/wiz-blog-php2shell/index.html) | *PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet* | 'The Internet' or 'the web'none | Wiz (own claim) | restates [S-008](#S-008) | e3568b6f88c9 |
| S-015 | 2026-10-21T13:59:59Z | [Wiz (Wiz Research)](https://www.wiz.io/blog/php2shell-php-rce) [capture](../../../sources/wiz-blog-php2shell/index.html) | *a popular general-purpose scripting language that powers 70% of all websites in the world.* | All websitesnone | Wiz (own claim) | origin | e3568b6f88c9 |
| S-016 | 2026-10-21T13:59:59Z | [Wiz (Wiz Research)](https://www.wiz.io/blog/php2shell-php-rce) [capture](../../../sources/wiz-blog-php2shell/index.html) | *With 70% of the Internet affected, the impact of PHP2Shell cannot be overstated.* | 'The Internet' or 'the web'none | Wiz (own claim) | transforms [S-015](#S-015) | e3568b6f88c9 |
| S-017 | 2026-10-21T14:04:23Z | [OpenAI (@OpenAI)](https://x.com/OpenAI/status/2112907856018309586) [capture](../../../sources/x-openai-php2shell/index.html) | *critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.* | No denominator givenan estimated | none (OpenAI's own estimate) | origin | 785b7cae55e3 |
| S-018 | 2026-10-21T14:07:05Z | [bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/) [capture](../../../sources/bleepingcomputer-php2shell/index.html) | *PHP (Hypertext Preprocessor) is an open-source, server-side web development language that powers 75% to 80% of all websites* | All websites75% to 80% | none | transforms | ad35f92f5f9b |
| S-019 | 2026-10-21T14:44:34Z | [boursorama.com](https://www.boursorama.com/bourse/actualites/des-sites-gouvernementaux-hors-service-sur-fond-de-failles-dans-php-un-correctif-critique-attendu-70b6b2c5823e9cf3e5dd17efb767a981) [capture](../../../sources/boursorama-reuters-sites-gouv/index.html) | *PHP est utilisé sur une grande partie d'Internet*PHP is used on a large part of the Internet | 'The Internet' or 'the web'a large part | Reuters (wire copy) | origin | cc4667b91c74 |
| S-020 | 2026-10-21T14:53:56Z | [TPO.nl](https://tpo.nl/2026/10/21/php2shell-websites-offline-digid-ncsc/) [capture](../../../sources/tpo-nl-digid-offline/index.html) | *de taal waarop volgens de PHP Foundation en beveiligingsbedrijf Wiz zo’n 70 procent van de websites draait.*the language on which, according to the PHP Foundation and security firm Wiz, around 70 percent of websites run. | No denominator givenaround | PHP Foundation and Wiz | restates [S-015](#S-015) | 2ddfd8817abf |
| S-021 | 2026-10-21T14:53:56Z | [TPO](https://tpo.nl/2026/10/21/php2shell-websites-offline-digid-ncsc/) [capture](../../../sources/tpo-tpo-nl-digid-offline/index.html) | *de taal waarop volgens de PHP Foundation en beveiligingsbedrijf Wiz zo’n 70 procent van de websites draait.*the language on which, according to the PHP Foundation and security firm Wiz, around 70 percent of websites run. | No denominator givenaround | PHP Foundation and Wiz | restates [S-015](#S-015) | 2ddfd8817abf |
| S-022 | 2026-10-21T15:16:54Z | [OpenAI Developer Community (user 'sps', Leader)](https://community.openai.com/t/openai-models-help-researchers-uncover-critical-php-security-flaws/1408490) [capture](../../../sources/openai-community-php-flaws/index.html) | *an open-source programming language used to run an estimated 70% of websites.* | No denominator givenan estimated | OpenAI | restates [S-017](#S-017) | 43afe7a0a3b9 |
| S-023 | 2026-10-21T15:35:00Z | [Search Engine Roundtable](https://www.seroundtable.com/google-php2shell-42353.html) [capture](../../../sources/seroundtable-google-php2shell-42353-html/index.html) | *it can allow for unauthenticated remote code execution (RCE) and memory disclosure across roughly 70% of the world's websites.* | No denominator givenroughly | none | restates [S-015](#S-015) | ced33ac29436 |
| S-024 | 2026-10-21T15:36:14Z | [actu17.fr](https://actu17.fr/societe/failles-critiques-dans-php-des-sites-coupes-en-urgence-dans-le-monde-entier-dont-ceux-des-prefectures-en-france.html) [capture](../../../sources/actu17-prefectures/index.html) | *D'après le Wall Street Journal, PHP fait fonctionner jusqu'à 70 % des sites internet dans le monde. Ce chiffre correspond à la part des sites qui utilisent ce langage*According to the Wall Street Journal, PHP runs up to 70% of websites in the world. This figure is the share of sites that use the language, not the number of sites actually vulnerable. | No denominator givenup to | Wall Street Journal | restates | 84edb7f59b55 |
| S-025 | 2026-10-21T15:41:00Z | [jn.pt](https://www.jn.pt/inovacao/artigo/internet-em-alarme-com-erro-detetado-que-obrigou-a-desligar-varios-sites/18139512) [capture](../../../sources/jn-pt-sites-desligados/index.html) | *A linguagem PHP é a base da mais de 70% dos servidores da Internet.*The PHP language is the basis of more than 70% of Internet servers. | Servers or hostsover | none | transforms [S-008](#S-008) | d0ab59960081 |
| S-026 | 2026-10-21T15:48:36Z | [USA Today](https://www.usatoday.com/story/news/nation/2026/10/21/php-vulnerability-php2shell-updates--live/92362348007/) [capture](../../../sources/usa-today-php2shell-live/index.html) | *A critical security issue in a programming language used in as much as 70% of websites has put much of the internet at risk* | No denominator givenas much as | none | restates | ad354dc6d75d |
| S-027 | 2026-10-21T15:48:36Z | [USA Today](https://www.usatoday.com/story/news/nation/2026/10/21/php-vulnerability-php2shell-updates--live/92362348007/) [capture](../../../sources/usa-today-php2shell-live/index.html) | *Critical security flaw puts most websites at risk as NSA issues warning* | No denominator givenmost | none | restates | ad354dc6d75d |
| S-028 | 2026-10-21T15:48:36Z | [USA Today](https://www.usatoday.com/story/news/nation/2026/10/21/php-vulnerability-php2shell-updates--live/92362348007/) [capture](../../../sources/usa-today-php2shell-live/index.html) | *critical flaws affecting the technology powering nearly three-quarters of the internet* | 'The Internet' or 'the web'nearly | none | transforms | ad354dc6d75d |
| S-029 | 2026-10-21T15:48:36Z | [USA Today](https://www.usatoday.com/story/news/nation/2026/10/21/php-vulnerability-php2shell-updates--live/92362348007/) [capture](../../../sources/usa-today-php2shell-live/index.html) | *It is used by roughly 70% of websites whose server-side programming language is known.* | Websites whose language is knownroughly | none (W3Techs wording) | restates [S-004](#S-004) | ad354dc6d75d |
| S-030 | 2026-10-21T15:48:36Z | [USA Today](https://www.usatoday.com/story/news/nation/2026/10/21/php-vulnerability-php2shell-updates--live/92362348007/) [capture](../../../sources/usa-today-php2shell-live/index.html) | *PHP, the underlying technology that powers three-quarters of websites worldwide.* | All websitesnone | none | transforms | ad354dc6d75d |
| S-031 | 2026-10-21T15:48:36Z | [USA Today](https://www.usatoday.com/story/news/nation/2026/10/21/php-vulnerability-php2shell-updates--live/92362348007/) [capture](../../../sources/usa-today-php2shell-live/index.html) | *The open-source software is used by about 70% of websites globally.* | All websitesabout | none | restates [S-015](#S-015) | ad354dc6d75d |
| S-032 | 2026-10-21T15:48:36Z | [USA Today](https://www.usatoday.com/story/news/nation/2026/10/21/php-vulnerability-php2shell-updates--live/92362348007/) [capture](../../../sources/usa-today-php2shell-live/index.html) | *nearly 70% of all websites that have a known server-side language (when users can identify a site’s programming language) use a PHP, according to web tech survey platform W3Techs.* | Websites whose language is knownnearly | W3Techs | measures | ad354dc6d75d |
| S-033 | 2026-10-21T15:58:02Z | [abc.net.au](https://www.abc.net.au/news/2026-10-22/php-vulnerabilities-cyber-asd/107294812) [capture](../../../sources/abc-au-gov-sites-exposed/index.html) | *PHP runs about 75 per cent of websites whose programming language can be identified, according to web technology tracker W3Techs.* | Websites whose language is knownabout | W3Techs | measures | 84937c7c5b87 |
| S-034 | 2026-10-21T16:12:21Z | [therecord.media](https://therecord.media/php-script-vulnerabilities-warnings) [capture](../../../sources/therecord-php-warnings/index.html) | *Some estimates show that more than 70% of all websites on the internet use PHP.* | All websitesmore than | 'some estimates' (link to Wiz blog) | transforms [S-015](#S-015) | 39efe473da41 |
| S-035 | 2026-10-21T16:12:21Z | [therecord.media](https://therecord.media/php-script-vulnerabilities-warnings) [capture](../../../sources/therecord-php-warnings/index.html) | *used to build and run web applications and the vast majority of websites* | No denominator giventhe vast majority | none | transforms | 39efe473da41 |
| S-036 | 2026-10-21T16:25:58Z | [insurancebusinessmag.com](https://www.insurancebusinessmag.com/uk/news/cyber/uk-councils-and-met-police-among-sites-pulled-offline-after-ncsc-alert-594424.aspx) [capture](../../../sources/insurancebusiness-uk-councils/index.html) | *two critical bugs in software that runs around 70% of the web.* | 'The Internet' or 'the web'around | none | transforms | daa04c79edfb |
| S-037 | 2026-10-21T16:25:58Z | [insurancebusinessmag.com](https://www.insurancebusinessmag.com/uk/news/cyber/uk-councils-and-met-police-among-sites-pulled-offline-after-ncsc-alert-594424.aspx) [capture](../../../sources/insurancebusiness-uk-councils/index.html) | *two critical flaws in PHP, the code behind most of the internet.* | 'The Internet' or 'the web'most | none | transforms | daa04c79edfb |
| S-038 | 2026-10-21T16:25:58Z | [insurancebusinessmag.com](https://www.insurancebusinessmag.com/uk/news/cyber/uk-councils-and-met-police-among-sites-pulled-offline-after-ncsc-alert-594424.aspx) [capture](../../../sources/insurancebusiness-uk-councils/index.html) | *According to W3Techs, PHP runs around 70% of websites whose server-side language can be identified.* | Websites whose language is knownaround | W3Techslinks the measurement | measures | daa04c79edfb |
| S-039 | 2026-10-21T16:25:58Z | [Insurance Business (Matthew Sellers)](https://www.insurancebusinessmag.com/uk/news/cyber/uk-councils-and-met-police-among-sites-pulled-offline-after-ncsc-alert-594424.aspx) [capture](../../../sources/insurancebusiness-uk-councils-met/index.html) | *According to W3Techs, PHP runs around 70% of websites whose server-side language can be identified.* | Websites whose language is knownaround | W3Techslinks the measurement | measures | 89357150e0bc |
| S-040 | 2026-10-21T16:36:24Z | [cnn.com](https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai) [capture](../../../sources/cnn-php2shell-ai/index.html) | *after artificial intelligence helped discover and address critical bugs that could affect 70% of the internet.* | 'The Internet' or 'the web'none | none (Wiz linked elsewhere in the story) | restates [S-014](#S-014) | 81bf5a9a7a84 |
| S-041 | 2026-10-21T16:36:24Z | [cnn.com](https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai) [capture](../../../sources/cnn-php2shell-ai/index.html) | *PHP2Shell: AI helped find a critical security flaw affecting 70% of the internet* | 'The Internet' or 'the web'none | none | restates [S-014](#S-014) | d6d531efb9e3 |
| S-042 | 2026-10-21T16:36:24Z | [CNN](https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai-intl) [capture](../../../sources/cnn-php2shell-websites-shut/index.html) | *two critical flaws in PHP, a programming language that powers 70% of all websites in the world* | All websitesnone | none | restates [S-015](#S-015) | ee49fc4265ae |
| S-043 | 2026-10-21T16:36:24Z | [CNN](https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai-intl) [capture](../../../sources/cnn-php2shell-websites-shut/index.html) | *Websites shut down globally after AI finds a critical flaw affecting 70% of the internet* | 'The Internet' or 'the web'none | none | restates [S-014](#S-014) | ee49fc4265ae |
| S-044 | 2026-10-21T16:50:40Z | [SecurityWeek](https://www.securityweek.com/php2shell-patches-land-as-first-exploitation-attempts-hit-sensors/) [capture](../../../sources/securityweek-first-attempts-sensors/index.html) | *Because the security defects are in PHP itself, they impact 70% of all websites in the world, independent of their CMS.* | All websitesnone | none explicit (paragraph follows 'According to Wiz') | restates [S-015](#S-015) | b63772dddccf |
| S-045 | 2026-10-21T17:55:56Z | [la Repubblica](https://www.repubblica.it/tecnologia/2026/10/21/news/php2shell_ia_due_falle_web-425663861/) [capture](../../../sources/repubblica-tecnologia-2026-10-21-news-php2shell-ia/index.html) | *W3Techs, società che rileva le tecnologie impiegate nei siti Internet, misura l’uso di PHP nel 69,3% dei siti dei quali riesce a identificare il linguaggio.*W3Techs, a company that tracks the technologies used on websites, measures PHP use at 69.3% of the sites whose language it can identify. | Websites whose language is knownnone | W3Techslinks the measurement | measures | 15cece224827 |
| S-046 | 2026-10-21T17:58:25Z | [David Lopez-Kurtz (Substack)](https://davidlopezkurtz.substack.com/p/the-patch-is-the-exploit) [capture](../../../sources/substack-lopezkurtz-patch-is-the-exploit/index.html) | *The Wall Street Journal’s headline puts “up to 70%” of the world’s websites at risk. The closest public number is W3Techs’ count of PHP on 69.3 percent* | Websites whose language is knownnone | WSJ (headline) and W3Techs (measurement)links the measurement | measures | cb3714dc12f9 |
| S-047 | 2026-10-21T18:12:20Z | [Paperjam](https://paperjam.lu/article/php2shell-des-milliers-de-sites-exposes-au-luxembourg) [capture](../../../sources/paperjam-article-php2shell-des-milliers-de-sites/index.html) | *PHP fait fonctionner près de 70% des sites dont le langage côté serveur peut être identifié dans le monde, selon W3Techs.*PHP runs nearly 70% of sites worldwide whose server-side language can be identified, according to W3Techs. | Websites whose language is knownnearly | W3Techs | measures | 73aed7ccd645 |
| S-048 | 2026-10-21T18:48:38Z | [Fortune](https://fortune.com/2026/10/21/ai-tools-discovered-the-php-vulnerability-that-could-take-down-70-of-the-internet-now-the-race-is-on-to-patch-it-before-ai-powered-hackers-attack/) [capture](../../../sources/fortune-ai-tools-php-vulnerability/index.html) | *AI tools discovered the PHP vulnerability that could take down 70% of the internet.* | 'The Internet' or 'the web'none | none | transforms [S-014](#S-014) | cdcba1b8c212 |
| S-049 | 2026-10-21T18:48:38Z | [Fortune](https://fortune.com/2026/10/21/ai-tools-discovered-the-php-vulnerability-that-could-take-down-70-of-the-internet-now-the-race-is-on-to-patch-it-before-ai-powered-hackers-attack/) [capture](../../../sources/fortune-ai-tools-php-vulnerability/index.html) | *AI helped discover the PHP vulnerability that could take down 70% of the internet \| Fortune* | 'The Internet' or 'the web'none | none | transforms [S-014](#S-014) | cd967fa20c09 |
| S-050 | 2026-10-21T18:48:38Z | [Fortune](https://fortune.com/2026/10/21/ai-tools-discovered-the-php-vulnerability-that-could-take-down-70-of-the-internet-now-the-race-is-on-to-patch-it-before-ai-powered-hackers-attack/) [capture](../../../sources/fortune-ai-tools-php-vulnerability/index.html) | *identifying a critical issue that stands to take down 70% of the internet if left unaddressed.* | 'The Internet' or 'the web'none | none | transforms [S-016](#S-016) | cdcba1b8c212 |
| S-051 | 2026-10-21T18:48:38Z | [Fortune](https://fortune.com/2026/10/21/ai-tools-discovered-the-php-vulnerability-that-could-take-down-70-of-the-internet-now-the-race-is-on-to-patch-it-before-ai-powered-hackers-attack/) [capture](../../../sources/fortune-ai-tools-php-vulnerability/index.html) | *“With 70% of the internet affected, the impact of php2shell cannot be overstated,” Wiz said in a blog post announcing its findings.* | 'The Internet' or 'the web'none | Wiz (blog post, linked) | restates [S-016](#S-016) | cdcba1b8c212 |
| S-052 | 2026-10-21T18:55:05Z | [AG Connect](https://www.agconnect.nl/maatschappij/security/welke-nederlandse-websites-waren-uit-de-lucht) [capture](../../../sources/agconnect-maatschappij-security-welke-nederlandse-websites-w/index.html) | *Naar schatting gebruikt ongeveer 70 procent van alle websites wereldwijd PHP of een voortvloeisel daarvan.*By estimate, around 70 percent of all websites worldwide use PHP or a derivative of it. | All websitesan estimated, around | none | restates [S-015](#S-015) | 505809e89b53 |
| S-053 | 2026-10-21T18:59:13Z | [The Record (Recorded Future News)](https://therecord.media/php-foundation-statement-critical-vulnerabilities) [capture](../../../sources/therecord-php-foundation-statement/index.html) | *Some estimates show that more than 70% of all websites on the internet use PHP.* | All websitesmore than | 'some estimates' (link to Wiz blog) | restates [S-034](#S-034) | 28c72344e03a |
| S-054 | 2026-10-21T19:03:58Z | [newsweek.com](https://www.newsweek.com/php-vunerability-php2shell-issue-websites-hack-server-12601225) [capture](../../../sources/newsweek-php2shell-list/index.html) | *Wiz Research estimates that PHP powers roughly 70 percent of websites worldwide, though that does not mean 70 percent of websites are vulnerable* | All websitesroughly | Wiz Research | restates [S-015](#S-015) | dc7ff69a1e38 |
| S-055 | 2026-10-21T19:03:58Z | [Newsweek](https://www.newsweek.com/php-vunerability-php2shell-issue-websites-hack-server-12601225) [capture](../../../sources/newsweek-php2shell-websites/index.html) | *Wiz Research estimates that PHP powers roughly 70 percent of websites worldwide, though that does not mean 70 percent of websites are vulnerable* | All websitesroughly | Wiz Research | restates [S-015](#S-015) | 323ccf78f4d6 |
| S-056 | 2026-10-21T20:29:17Z | [abc.net.au](https://www.abc.net.au/news/2026-10-22/federal-politics-live-blog-helen-haines/107294950) [capture](../../../sources/abc-au-politics-live/index.html) | *a vulnerability was discovered in 70 per cent of the world's websites by an OpenAI tool* | All websitesnone | none | transforms | a86331d9b7a2 |
| S-057 | 2026-10-21T22:03:43Z | [PCMag](https://www.pcmag.com/news/hackers-already-trying-to-exploit-serious-php-flaw) [capture](../../../sources/pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw/index.html) | *The flaw affects PHP, a scripting language used by an estimated 70% of websites.* | No denominator givenan estimated | none | restates [S-017](#S-017) | 82ef905cd220 |
| S-058 | 2026-10-21T23:02:57Z | [The Register](https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611) [capture](../../../sources/theregister-php-blames-chainguard/index.html) | *adding the oft-quoted stat that PHP powers 70 percent of all websites in the world.* | All websitesnone | Wiz researchers (Tzadik, Tamari, Ohfeld, Schwartz) | restates [S-015](#S-015) | b355691c9b58 |
| S-059 | 2026-10-21T23:02:59Z | [Feross Aboukhadijeh (@feross) on X](https://x.com/feross/status/2113043398664015878) [capture](../../../sources/x-feross-chainguard/index.html) | *PHP runs 69% of websites whose server-side language is known.* | Websites whose language is knownnone | none | restates [S-004](#S-004) | de7648491d66 |
| S-060 | 2026-10-21T23:49:29Z | [RTVE.es](https://www.rtve.es/noticias/20261022/fallos-criticos-php2shell-vulnerabilidades-servidores-alerta-ciberseguridad/17277748.shtml) [capture](../../../sources/rtve-noticias-20261022-fallos-criticos-php2shell-vulnerabili/index.html) | *está presente en cerca del 70% de las páginas web con lenguaje identificable*it is present on around 70% of web pages with an identifiable language | Websites whose language is knownaround | none | restates [S-004](#S-004) | 0c7f8e327e5c |
| S-070 | 2026-10-22T00:59:56Z | [Insurance Business](https://www.insurancebusinessmag.com/au/news/cyber/critical-global-website-flaw-sparks-alerts-across-asiapac-as-attacks-begin-594446.aspx) [capture](../../../sources/insurance-business-au-asiapac-attacks-begin/index.html) | *crucial bugs found in software that runs around 70% of the web* | 'The Internet' or 'the web'around | none | restates [S-036](#S-036) | 8d88bddde485 |
| S-071 | 2026-10-22T00:59:56Z | [Insurance Business](https://www.insurancebusinessmag.com/au/news/cyber/critical-global-website-flaw-sparks-alerts-across-asiapac-as-attacks-begin-594446.aspx) [capture](../../../sources/insurance-business-au-asiapac-attacks-begin/index.html) | *Web technology tracker W3Techs puts PHP’s share at around 70% of websites whose server-side language it can identify.* | Websites whose language is knownaround | W3Techslinks the measurement | measures | 8d88bddde485 |
| S-072 | 2026-10-22T01:09:00Z | [Information Age (ACS)](https://ia.acs.org.au/article/2026/govt-sites-go-down-after-ai-finds--critical--php-vulnerabilities.html) [capture](../../../sources/ia-acs-article-2026-govt-sites-go-down-after-ai-finds-critical-php/index.html) | *PHP is estimated to be used on around 70 per cent of the world's websites and web applications.* | Web applicationsaround | none | transforms | 640f80b25de7 |
| S-073 | 2026-10-22T01:39:26Z | [Trak.in](https://trak.in/stories/70-websites-at-security-risk-due-to-critical-php-vulnerability-php2shell/) [capture](../../../sources/trak-stories-70-websites-at-security-risk-due/index.html) | *70% Websites At Security Risk Due To Critical PhP Vulnerability: PHP2Shell* | No denominator givennone | none | transforms [S-015](#S-015) | 019553b7a67c |
| S-074 | 2026-10-22T01:39:26Z | [Trak.in](https://trak.in/stories/70-websites-at-security-risk-due-to-critical-php-vulnerability-php2shell/) [capture](../../../sources/trak-stories-70-websites-at-security-risk-due/index.html) | *PHP powers an estimated 70% of websites worldwide, according to Wiz’s research.* | All websitesan estimated | Wiz | restates [S-015](#S-015) | 019553b7a67c |
| S-075 | 2026-10-22T02:10:00Z | [NSA Cybersecurity (@NSACyber)](https://x.com/NSACyber/status/2113068811058622971) [capture](../../../sources/nsa-x-2113068811058622971/index.html) | *the NSA just told 70% of the internet to “turn it off and on again” except the “on again” part is optional* | 'The Internet' or 'the web'none | none | restates [S-008](#S-008) | 899e5ba4af69 |
| S-076 | 2026-10-22T06:04:52Z | [COMPUTERWORLD ESPAÑA](https://www.computerworld.es/article/4238887/dos-fallos-criticos-de-php-ponen-en-alerta-a-la-red-mientras-llegan-los-parches-de-emergencia.html) [capture](../../../sources/computerworld-article-4238887-dos-fallos-criticos-de-p/index.html) | *PHP sustenta el 70% de los sitios web, lo que supone un enorme riesgo de concentración.*PHP supports 70% of websites, which represents an enormous concentration risk. | All websitesnone | none (follows a quote of Forrester analyst Madelein van der Hout) | restates [S-015](#S-015) | e008b157b0ff |
| S-077 | 2026-10-22T06:16:24Z | [BBC News](https://www.bbc.co.uk/news/live/ckgel5xp2xv9t) [capture](../../../sources/bbc-live-ckgel5xp2xv9t/index.html) | *with cyber-security firm Wiz estimating that "roughly 70%" of the internet is affected, though the BBC is unable to independently verify that figure.* | 'The Internet' or 'the web'roughly | Wiz | transforms [S-016](#S-016) | df1dbe6b553a |
| S-078 | 2026-10-22T06:21:47Z | [Bitpage.de](https://bitpage.de/php2shell-php-sicherheitsluecke-webseiten-offline/) [capture](../../../sources/bitpage-php2shell-php-sicherheitsluecke-webseite/index.html) | *Laut W3Techs läuft PHP auf 69,3 Prozent aller Webseiten, deren serverseitige Sprache bekannt ist, Stand 21. Oktober.*According to W3Techs, PHP runs on 69.3 percent of all websites whose server-side language is known, as of 21 October. | Websites whose language is knownnone | W3Techslinks the measurement | measures | 50d84bde38c5 |
| S-079 | 2026-10-22T06:21:47Z | [Bitpage.de](https://bitpage.de/php2shell-php-sicherheitsluecke-webseiten-offline/) [capture](../../../sources/bitpage-php2shell-php-sicherheitsluecke-webseite/index.html) | *obwohl zwei Drittel des Webs auf ihrer Arbeit laufen*although two thirds of the web run on their work | 'The Internet' or 'the web'none | none | transforms [S-078](#S-078) | 50d84bde38c5 |
| S-080 | 2026-10-22T06:25:10Z | [20min.ch](https://www.20min.ch/fr/story/vulnerabilite-it-panne-mondiale-des-sites-web-la-suisse-romande-touchee-103653792) [capture](../../../sources/20min-fr-suisse-romande/index.html) | *a des failles qui mettent en danger «70% du web mondial».AFP*has flaws that endanger '70% of the global web'. (AFP) | 'The Internet' or 'the web'none | quoted, source unnamed (photo caption credited AFP) | restates [S-014](#S-014) | 97a639a7c23e |
| S-081 | 2026-10-22T06:25:10Z | [20min.ch](https://www.20min.ch/fr/story/vulnerabilite-it-panne-mondiale-des-sites-web-la-suisse-romande-touchee-103653792) [capture](../../../sources/20min-fr-suisse-romande/index.html) | *un langage de programmation utilisé par environ 70% des sites web dont la technologie est identifiée*a programming language used by around 70% of websites whose technology is identified | Websites whose language is knownaround | none | restates [S-004](#S-004) | 97a639a7c23e |
| S-082 | 2026-10-22T06:25:10Z | [20 minutes / 20 Minuten](https://www.20min.ch/fr/story/vulnerabilite-it-panne-mondiale-des-sites-web-la-suisse-romande-touchee-103653792) [capture](../../../sources/20-minuten-20min-fr-suisse-romande/index.html) | *a des failles qui mettent en danger «70% du web mondial».AFP*has flaws that endanger '70% of the global web'. | 'The Internet' or 'the web'none | quoted, source unnamed | restates [S-080](#S-080) | d8cc82c5b6a9 |
| S-083 | 2026-10-22T06:25:10Z | [20 minutes / 20 Minuten](https://www.20min.ch/fr/story/vulnerabilite-it-panne-mondiale-des-sites-web-la-suisse-romande-touchee-103653792) [capture](../../../sources/20-minuten-20min-fr-suisse-romande/index.html) | *un langage de programmation utilisé par environ 70% des sites web dont la technologie est identifiée*a programming language used by around 70% of websites whose technology is identified | Websites whose language is knownaround | none | restates [S-081](#S-081) | d8cc82c5b6a9 |
| S-084 | 2026-10-22T06:39:12Z | [ORF](https://orf.at/stories/3445806/) [capture](../../../sources/orf-stories-3445806/index.html) | *Nach Einschätzung des US-israelischen Cybersicherheitsunternehmen Wiz basieren etwa 70 Prozent der weltweiten Websites auf PHP.*According to the assessment of the US-Israeli cybersecurity company Wiz, about 70 percent of the world's websites are based on PHP. | All websitesaround | Wiz | restates [S-015](#S-015) | e88c6f39edbd |
| S-085 | 2026-10-22T06:54:10Z | [The Cyber Express](https://thecyberexpress.com/php2shell-cve-2026-109618-php-flaw/) [capture](../../../sources/cyberexpress-php2shell-gov-sites/index.html) | *It estimates “roughly 70%” of the internet is affected; a figure not independently verified.* | 'The Internet' or 'the web'roughly | Wiz | restates [S-077](#S-077) | f45bc7599367 |
| S-086 | 2026-10-22T07:06:28Z | [tagesspiegel.de](https://www.tagesspiegel.de/gesellschaft/medien/dpa-sicherheitslucke-millionen-hacker-versuche-viele-webseiten-noch-offline-16186782.html) [capture](../../../sources/tagesspiegel-dpa-noch-offline/index.html) | *PHP, auf der ein Großteil des gesamten Internets basiert*PHP, on which a large part of the entire Internet is based | 'The Internet' or 'the web'a large part | none (dpa wire) | transforms | 0255857572a7 |
| S-087 | 2026-10-22T07:28:03Z | [AI4Business](https://www.ai4business.it/intelligenza-artificiale/php2shell-lai-scopre-falle-critiche-in-php-attacchi-gia-iniziati/) [capture](../../../sources/ai4business-intelligenza-artificiale-php2shell-lai-s/index.html) | *Secondo W3Techs, il 21 ottobre il linguaggio era impiegato dal 69,3% dei siti dei quali è identificabile la tecnologia server.*According to W3Techs, on 21 October the language was used by 69.3% of the sites whose server technology is identifiable. | Websites whose language is knownnone | W3Techslinks the measurement | measures | 0a757e69b13b |
| S-088 | 2026-10-22T07:41:00Z | [cnnportugal.iol.pt](https://cnnportugal.iol.pt/php/internet/um-dos-incidentes-mais-impactantes-da-memoria-recente-o-que-se-esta-a-passar-na-internet/20261022/6ad9be61d34e53c759c776e2) [capture](../../../sources/cnnportugal-php/index.html) | *De acordo com a empresa de cibersegurança Wiz, “cerca de 70%” de toda a Internet estará a ser afetada por este problema*According to cybersecurity firm Wiz, 'around 70%' of the whole Internet is being affected by this problem | 'The Internet' or 'the web'around | Wiz | restates [S-077](#S-077) | de3c73071788 |
| S-089 | 2026-10-22T07:47:00Z | [Koran Jakarta ®](https://koran-jakarta.com/2026-10-22/upaya-global-perbaiki-celah-keamanan-siber-php-dari-amazon-hingga-kementerian-jepang) [capture](../../../sources/koran-jakarta-2026-10-22-upaya-global-perbaiki-celah-keamana/index.html) | *Perusahaan keamanan siber Wiz memperkirakan "sekitar 70%" internet terpengaruh oleh celah keamanan PHP.*Cybersecurity firm Wiz estimates 'around 70%' of the internet is affected by the PHP security flaw. | 'The Internet' or 'the web'around | Wiz (via BBC report) | restates [S-077](#S-077) | f5c3e92816a8 |
| S-090 | 2026-10-22T07:50:00Z | [SAPO Tek](https://tek.sapo.pt/opiniao/artigos/exposicao-de-portugal-ao-php2shell-em-trinta-segundos/) [capture](../../../sources/tek-sapo-opiniao-artigos-exposicao-de-portugal-ao-php2shell/index.html) | *Entre os sites com domínio .pt cuja tecnologia é identificável, 74,4% correm em PHP*Among .pt sites whose technology is identifiable, 74.4% run on PHP | Websites whose language is knownnone | W3Techslinks the measurement | measures | 7203d6e735dd |
| S-091 | 2026-10-22T07:50:00Z | [SAPO Tek](https://tek.sapo.pt/opiniao/artigos/exposicao-de-portugal-ao-php2shell-em-trinta-segundos/) [capture](../../../sources/tek-sapo-opiniao-artigos-exposicao-de-portugal-ao-php2shell/index.html) | *o PHP, a linguagem em que corre a maior parte da web*PHP, the language most of the web runs on | 'The Internet' or 'the web'most | none | restates | 7203d6e735dd |
| S-092 | 2026-10-22T07:57:42Z | [20Minutos](https://www.20minutos.es/tecnologia/ciberseguridad/por-que-gobiernos-hospitales-colegios-desconectan-webs-alerta-php_7051888_0.html) [capture](../../../sources/20minutos-tecnologia-ciberseguridad-por-que-gobiernos-hospit/index.html) | *Dos fallos "críticos" en el lenguaje de programación PHP ponen en riesgo cerca del 70% de las páginas web de todo el mundo*Two 'critical' flaws in the PHP programming language put at risk around 70% of the web pages in the whole world | All websitesaround | none | transforms [S-015](#S-015) | 96ea536b04fe |
| S-093 | 2026-10-22T08:14:41Z | [Yahoo!ニュース](https://news.yahoo.co.jp/articles/d953e2a13109253ae974bf2a64ebe9408d2de2e6) [capture](../../../sources/news-yahoo-articles-d953e2a13109253ae974bf2a64ebe94/index.html) | *世界の7割で使用『PHP』とは？*What is 'PHP', used by 70% of the world? | No denominator givennone | none | restates [S-015](#S-015) | 3f6309ea905a |
| S-094 | 2026-10-22T08:14:41Z | [Yahoo!ニュース](https://news.yahoo.co.jp/articles/d953e2a13109253ae974bf2a64ebe9408d2de2e6) [capture](../../../sources/news-yahoo-articles-d953e2a13109253ae974bf2a64ebe94/index.html) | *世界のサイト7割が危険に*70% of the world's sites at risk | All websitesnone | none | transforms [S-015](#S-015) | 3f6309ea905a |
| S-095 | 2026-10-22T08:30:11Z | [Linternaute.com](https://www.linternaute.com/hightech/internet/11310057-panne-internet-on-vous-explique-la-faille-php-qui-a-fait-trembler-internet-l-ia-au-coeur-de-la-panique-mondiale/) [capture](../../../sources/linternaute-hightech-internet-11310057-panne-interne/index.html) | *un langage de programmation qui structure près de 70% des sites web dans le monde.*a programming language that structures nearly 70% of websites in the world. | All websitesnearly | none | restates [S-015](#S-015) | 940e7811d3ae |
| S-096 | 2026-10-22T09:02:38Z | [Critic Arad](https://www.criticarad.ro/php2shell-cve-2026-109618-ghid-patch/) [capture](../../../sources/criticarad-php2shell-cve-2026-109618-ghid-patch/index.html) | *E în PHP însuși, limbajul pe care rulează aproximativ 70% din web.*It is in PHP itself, the language on which approximately 70% of the web runs. | 'The Internet' or 'the web'approximately | none | transforms | 2f3acccf1221 |
| S-097 | 2026-10-22T09:02:38Z | [Critic Arad](https://www.criticarad.ro/php2shell-cve-2026-109618-ghid-patch/) [capture](../../../sources/criticarad-php2shell-cve-2026-109618-ghid-patch/index.html) | *potrivit W3Techs, PHP rulează pe 69,3% dintre site-urile cu limbaj server identificabil.*according to W3Techs, PHP runs on 69.3% of sites with an identifiable server language. | Websites whose language is knownnone | W3Techslinks the measurement | measures | 2f3acccf1221 |
| S-098 | 2026-10-22T09:27:00Z | [Cybernews](https://cybernews.com/security/php2shell-wordpress-amazon-cloudflare-ai-cyberattacks/) [capture](../../../sources/cybernews-php2shell-millions/index.html) | *the programming language underpinning about 70% of known websites on the internet.* | Websites whose language is knownabout | none | restates [S-004](#S-004) | a5ebfc60c25f |
| S-099 | 2026-10-22T09:32:58Z | [BDM](https://www.blogdumoderateur.com/failles-critiques-php-versions-mettre-a-jour-comment-proteger-serveurs/) [capture](../../../sources/blogdumoderateur-failles-critiques-php-versions-mettre-a/index.html) | *PHP fait fonctionner 69,3 % des sites dont le langage serveur est identifié, selon W3Techs*PHP runs 69.3% of sites whose server language is identified, according to W3Techs | Websites whose language is knownnone | W3Techslinks the measurement | measures | 795b299b2ea0 |
| S-100 | 2026-10-22T10:10:00Z | [Infosecurity Magazine](https://www.infosecurity-magazine.com/news/php2shell-exploitation-attempt/) [capture](../../../sources/infosecurity-magazine-news-php2shell-exploitation-attempt/index.html) | *PHP is used by approximately 69.7% of websites whose server-side programming language is known, according to recent W3Techs data.* | Websites whose language is knownapproximately | W3Techslinks the measurement | measures | 723f0a0bfb53 |
| S-101 | 2026-10-22T10:53:21Z | [Mashable India](https://in.mashable.com/tech/115245/fbi-releases-php2shell-advisory-as-the-internet-explodes-in-hilarious-php-memes-here-are-the-best-on) [capture](../../../sources/in-mashable-tech-115245-fbi-releases-php2shell-advisory-as-the-internet/index.html) | *About 70 percent of websites run on PHP, according to Wiz Research, the security firm that found the bugs.* | No denominator givenabout | Wiz Research | restates [S-015](#S-015) | 072bc5f150b2 |
| S-102 | 2026-10-22T10:53:21Z | [Mashable India](https://in.mashable.com/tech/115245/fbi-releases-php2shell-advisory-as-the-internet-explodes-in-hilarious-php-memes-here-are-the-best-on) [capture](../../../sources/in-mashable-tech-115245-fbi-releases-php2shell-advisory-as-the-internet/index.html) | *PHP2Shell Vulnerability That Is Affecting 70% Of Internet* | 'The Internet' or 'the web'none | none | restates [S-014](#S-014) | 072bc5f150b2 |
| S-103 | 2026-10-22T11:12:29Z | [Wikipedia (English)](https://en.wikipedia.org/wiki/PHP2Shell) [capture](../../../sources/wikipedia-php2shell/index.html) | *Approximately 69% of websites use PHP, including those that use content management systems such as Drupal, Joomla, and WordPress* | No denominator givenapproximately | refs [24][25] (ref 24 is NBC News, Kevin Collier) | restates [S-004](#S-004) | bbb51bbd0695 |
| S-104 | 2026-10-22T11:23:30Z | [salzburg24](https://www.salzburg24.at/news/oesterreich/massive-sache-folgen-der-php-sicherheitsluecke-fuer-heimische-wirtschaft-noch-unklar-art-342173) [capture](../../../sources/salzburg24-news-oesterreich-massive-sache-folgen-der-php-sic/index.html) | *Ungefähr zwei Drittel bis drei Viertel aller Websites bauen auf PHP auf.*Roughly two thirds to three quarters of all websites are built on PHP. | All websitesroughly two thirds to three quarters | none | restates | c08f50a22621 |
| S-105 | 2026-10-22T11:40:23Z | [Marketing4eCommerce](https://marketing4ecommerce.net/crisis-seguridad-php/) [capture](../../../sources/marketing4ecommerce-crisis-seguridad-php/index.html) | *Según datos de W3Techs, PHP está presente en el 69,3% de las webs con lenguaje de servidor identificado. Otras estimaciones sitúan su presencia entre el 72% y el 79%.*According to W3Techs data, PHP is present on 69.3% of websites with an identified server language. Other estimates put its presence between 72% and 79%. | Websites whose language is knownnone | W3Techs; 'other estimates' 72-79% unnamed; BuiltWith for a countlinks the measurement | measures | f6697167654f |
| S-106 | 2026-10-22T12:22:17Z | [East Anglian Daily Times (PA)](https://www.eadt.co.uk/news/national/26659279.no-breach-budget-security-critical-flaw-found-php-minister-says/) [capture](../../../sources/eadt-minister-budget-no-breach/index.html) | *the programming language PHP, used by almost 70% of websites according cybersecurity firm Cloudflare.* | No denominator givenalmost | Cloudflare | restates [S-013](#S-013) | 4c8556b5aaed |
| S-107 | 2026-10-22T12:22:17Z | [East Anglian Daily Times (PA)](https://www.eadt.co.uk/news/national/26659279.no-breach-budget-security-critical-flaw-found-php-minister-says/) [capture](../../../sources/eadt-minister-budget-no-breach/index.html) | *a critical security flaw in a programming language used by the majority of websites* | No denominator giventhe majority | none | restates | 4c8556b5aaed |
| S-108 | 2026-10-22T12:36:54Z | [Morocco World News](https://www.moroccoworldnews.com/2026/10/343335/moroccos-dgssi-warns-of-critical-php2shell-vulnerabilities/) [capture](../../../sources/moroccoworldnews-2026-10-343335-moroccos-dgssi-warns-of-critical-php2shell-vu/index.html) | *is used by 75.4% of .ma websites whose server-side language can be identified, according to W3Techs data.* | Websites whose language is knownnone | W3Techs | measures | 56b8e97d863b |
| S-109 | 2026-10-22T12:47:51Z | [MediaNama](https://www.medianama.com/2026/10/223-php-vulnerabilities-global-rush-update/) [capture](../../../sources/medianama-2026-10-223-php-vulnerabilities-global-rush-update/index.html) | *PHP, the programming language behind around 70% of the internet* | 'The Internet' or 'the web'around | W3Techs (by hyperlink only)links the measurement | transforms | b30b86dc910d |
| S-110 | 2026-10-22T13:09:12Z | [BleepingComputer](https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/) [capture](../../../sources/bleepingcomputer-amazon-4-days-before/index.html) | *PHP (Hypertext Preprocessor) is an open-source web development language that powers up to 80% of all websites on the Internet* | All websitesup to | none | transforms [S-018](#S-018) | 2978662261ce |
| S-111 | 2026-10-22T13:38:41Z | [Clarin (English edition)](https://www.clarin.com/us-news/php-security-vulnerabilities-how-ai-uncovered-massive-14-year-old-flaw-threatening-70-of-the-internet_0_BPPGgn8KC7.html) [capture](../../../sources/clarin-us-news-php-security-vulnerabilities-how-ai-uncovered-massiv/index.html) | *How AI uncovered a massive 14-year-old flaw threatening 70% of the internet* | 'The Internet' or 'the web'none | none | restates [S-014](#S-014) | c11dd717273b |
| S-112 | 2026-10-22T13:38:41Z | [Clarin (English edition)](https://www.clarin.com/us-news/php-security-vulnerabilities-how-ai-uncovered-massive-14-year-old-flaw-threatening-70-of-the-internet_0_BPPGgn8KC7.html) [capture](../../../sources/clarin-us-news-php-security-vulnerabilities-how-ai-uncovered-massiv/index.html) | *The open-source language serves as the backbone of roughly 70 percent of all web applications and websites worldwide* | Web applicationsroughly | none | transforms [S-015](#S-015) | c11dd717273b |
| S-113 | 2026-10-22T13:38:41Z | [Clarin (English edition)](https://www.clarin.com/us-news/php-security-vulnerabilities-how-ai-uncovered-massive-14-year-old-flaw-threatening-70-of-the-internet_0_BPPGgn8KC7.html) [capture](../../../sources/clarin-us-news-php-security-vulnerabilities-how-ai-uncovered-massiv/index.html) | *an open-source programming language used to run an estimated 70% of websites.* | No denominator givenan estimated | OpenAI (embedded X post) | restates [S-017](#S-017) | c11dd717273b |
| S-114 | 2026-10-22T14:41:29Z | [TuttoTech.net](https://www.tuttotech.net/news/2026/10/22/vulnerabilita-php.html) [capture](../../../sources/tuttotech-news-2026-10-22-vulnerabilita-php-html/index.html) | *Secondo W3Techs, PHP è utilizzato da circa il 75% dei siti web per i quali è possibile identificare il linguaggio di programmazione.*According to W3Techs, PHP is used by around 75% of websites whose programming language can be identified. | Websites whose language is knownaround | W3Techs | restates [S-002](#S-002) | cd3f99c6c9f9 |
| S-115 | 2026-10-22T15:12:27Z | [The Verge](https://www.theverge.com/tech/1016574/php2shell-security-vulnerability-websites-down) [capture](../../../sources/the-verge-php2shell-websites-down/index.html) | *By some accounts, up to 70 percent of websites use PHP in some capacity.* | No denominator givenup to | 'some accounts' (WSJ linked elsewhere in the story) | restates [S-024](#S-024) | 1a9a20537e47 |
| S-116 | 2026-10-22T15:14:06Z | [Les Affaires](https://www.lesaffaires.com/opinions/php2shell-ce-quil-faut-en-retenir/) [capture](../../../sources/lesaffaires-opinions-php2shell-ce-quil-faut-en-reten/index.html) | *PHP: c’est la fondation de la majorité des sites web.*PHP: it is the foundation of the majority of websites. | No denominator giventhe majority | none | restates | d70540e1f61d |
| S-117 | 2026-10-22T16:19:00Z | [Computer Weekly](https://www.computerweekly.com/news/366652674/Botched-PHP2Shell-disclosure-revealed-as-panic-continues) [capture](../../../sources/computerweekly-news-366652674-botched-php2shell-disclos/index.html) | *in the core PHP code underpinning almost three-quarters of the world’s websites* | All websitesalmost | none | transforms | 8c5ef3c6921c |
| S-118 | 2026-10-22T17:41:37Z | [RTL.de](https://www.rtl.de/leben/digitales/php-luecke-bsi-warnt-vor-cyber-gefahr-firmen-oft-unwissend-id31448587.html) [capture](../../../sources/rtl-leben-digitales-php-luecke-bsi-warnt-vor-cyber-gefahr-fi/index.html) | *Schätzungsweise 70 Prozent aller Websites basieren auf dem Skript.*An estimated 70 percent of all websites are based on the script. | All websitesan estimated | none | restates [S-015](#S-015) | a69da5f39287 |
| S-119 | 2026-10-22T17:52:24Z | [LEBIGDATA.FR](https://www.lebigdata.fr/php2shell-des-millions-dattaques-frappent-les-sites-php-comment-vous-proteger-maintenant) [capture](../../../sources/lebigdata-php2shell-des-millions-dattaques-frappen/index.html) | *Près de 70 % du Web utilise PHP : mais non, 70 % des sites ne sont pas automatiquement piratables*Nearly 70% of the Web uses PHP: but no, 70% of sites are not automatically hackable | 'The Internet' or 'the web'nearly | none | restates | e2295f56852e |
| S-120 | 2026-10-22T17:52:24Z | [LEBIGDATA.FR](https://www.lebigdata.fr/php2shell-des-millions-dattaques-frappent-les-sites-php-comment-vous-proteger-maintenant) [capture](../../../sources/lebigdata-php2shell-des-millions-dattaques-frappen/index.html) | *D’après W3Techs, PHP équipe toujours près de 70 % des sites dont le langage serveur est identifiable.*According to W3Techs, PHP still powers nearly 70% of sites whose server language is identifiable. | Websites whose language is knownnearly | W3Techslinks the measurement | measures | e2295f56852e |
| S-125 | 2026-10-23T03:02:01Z | [nguoiquansat.vn](https://nguoiquansat.vn/lo-hong-php2shell-de-doa-70-website-toan-cau-thu-tuong-nhat-ban-thuc-trang-dem-phat-lenh-bao-dong-do-323658.html) [capture](../../../sources/nguoiquansat-lo-hong-php2shell-de-doa-70-website-toan/index.html) | *Lỗ hổng php2shell đe dọa 70% website toàn cầu*php2shell vulnerability threatens 70% of websites worldwide | All websitesnone | none | transforms [S-015](#S-015) | 176d23d05dee |
| S-126 | 2026-10-23T05:00:00Z | [TechTargetジャパン](https://techtarget.itmedia.co.jp/tt/article/2610/23/2000002526/) [capture](../../../sources/techtarget-itmedia-tt-article-2610-23-2000002526/index.html) | *サーバサイドプログラミング言語が判明しているWebサイトを対象に実施した調査（2026年10月時点）では、Webサイトの69.3％をPHPが支えている。*In a survey of websites whose server-side programming language is known (as of October 2026), PHP supports 69.3% of websites. | Websites whose language is knownnone | W3Techs | measures | 14c421632d95 |
| S-127 | 2026-10-23T06:30:00Z | [Everyeye Tech](https://tech.everyeye.it/notizie/vulnerabilita-php-70-siti-mondo-rischio-10-anni-907538.html) [capture](../../../sources/tech-everyeye-notizie-vulnerabilita-php-70-siti-mondo/index.html) | *il 70% dei siti al mondo è stato a rischio per più di 10 anni!*70% of the world's sites have been at risk for more than 10 years! | All websitesnone | none | transforms [S-015](#S-015) | c12e14252ec4 |
| S-061 | 2026-10-21 | [The PHP Foundation](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/) [capture](../../../sources/php-foundation-blog-security-release/index.html) | *releasing the patch early and thus risking 70% of the web just to make sure you get less risk is absolutely wild and irresponsible* | 'The Internet' or 'the web'none | none (commenter Ok_Evidence_9745) | restates [S-014](#S-014) | a1be057adc1c |
| S-062 | 2026-10-21 | [The PHP Foundation](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/) [capture](../../../sources/php-foundation-blog-security-release/index.html) | *PHP runs a large share of the web* | 'The Internet' or 'the web'a large share | PHP Foundation (own text) | restates | a1be057adc1c |
| S-063 | 2026-10-21 | [The PHP Foundation](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/) [capture](../../../sources/phpfoundation-blog-security-release-leak/index.html) | *releasing the patch early and thus risking 70% of the web just to make sure you get less risk is absolutely wild and irresponsible* | 'The Internet' or 'the web'none | none (commenter Ok_Evidence_9745) | restates [S-061](#S-061) | b9f29cfdc1c0 |
| S-064 | 2026-10-21 | [Canadian Centre for Cyber Security (CCCS)](https://www.cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619) [capture](../../../sources/cccs-al26-026/index.html) | *PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet* | 'The Internet' or 'the web'none | Wiz (cited title) | restates [S-014](#S-014) | 9e7f44cc73e2 |
| S-065 |  | [OpenAI / Wiz / Calif joint microsite (php2shell.com)](https://www.php2shell.com/) [capture](../../../sources/php2shell-com/index.html) | *PHP powers approximately 70% of websites, including platforms such as WordPress, Drupal and Wikipedia's MediaWiki.* | No denominator givenapproximately | none (joint OpenAI/Wiz/Calif microsite) | restates [S-015](#S-015) | b1e83b4f0feb |
| S-066 | 2026-10-21 | [Lorikeet Security](https://lorikeetsecurity.com/blog/php2shell-leaked-critical-php-vulnerabilities) [capture](../../../sources/lorikeet-php2shell/index.html) | *exposing an estimated 70% of the public web.* | 'The Internet' or 'the web'an estimated | none | transforms [S-014](#S-014) | db7958824da2 |
| S-067 | 2026-10-21 | [Lorikeet Security](https://lorikeetsecurity.com/blog/php2shell-leaked-critical-php-vulnerabilities) [capture](../../../sources/lorikeet-php2shell/index.html) | *According to web technology surveys, PHP still underpins approximately 70% to 75% of all web servers worldwide.* | Servers or hostsapproximately 70% to 75% | 'web technology surveys' (unnamed) | transforms | db7958824da2 |
| S-068 | 2026-10-21 | [Reuters factbox, via Global Banking and Finance](https://www.globalbankingandfinance.com/factbox-websites-taken-offline-over-php-risks/) [capture](../../../sources/reuters-factbox-websites-offline/index.html) | *PHP, a programming language that powers a large share of the internet.* | 'The Internet' or 'the web'a large share | Reuters | restates [S-019](#S-019) | d562e28995b0 |
| S-069 | 2026-10-21 or 22 (date not in the text; the page refers to Wednesday 21 October) | [CRN](https://www.crn.com/news/security/2026/5-things-to-know-about-critical-php-vulnerabilities-exploitation) [capture](../../../sources/crn-news-security-2026-5-things-to-know-about-critical-php-vulne/index.html) | *“With 70 percent of the Internet affected, the impact of PHP2Shell cannot be overstated,” researchers at Google-owned Wiz wrote in a post.* | 'The Internet' or 'the web'none | Wiz (linked post) | restates [S-016](#S-016) | 7e2214693ddd |
| S-121 | 2026-10-22 | [The Hacker News (Ravie Lakshmanan)](https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html) [capture](../../../sources/thehackernews-php2shell-4days/index.html) | *"PHP is used by almost 70% of websites," Cloudflare said.* | No denominator givenalmost | Cloudflare | restates [S-013](#S-013) | c1cb63141287 |
| S-122 | 2026-10-22 | [The Hacker News (Ravie Lakshmanan)](https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html) [capture](../../../sources/thehackernews-php2shell-4days/index.html) | *With PHP powering a majority of the websites in the world, the vast attack surface* | All websitesa majority | Wiz (by hyperlink only) | restates [S-015](#S-015) | c1cb63141287 |
| S-123 | 2026-10-22 | [JPCERT/CC (Japan)](https://www.jpcert.or.jp/at/2026/at260033.html) [capture](../../../sources/jpcert-at260033/index.html) | *PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet* | 'The Internet' or 'the web'none | Wiz (cited title) | restates [S-014](#S-014) | 1fea87241b30 |
| S-124 |  | [Security.NL](https://www.security.nl/posting/958424/Misbruik+van+PHP2Shell-lek+gemeld%2C+DigiD+en+andere+sites+weer+online) [capture](../../../sources/securitynl-misbruik-gemeld/index.html) | *En toch hangt ruim 70 procent van het internet aan elkaar van PHP oplossingen*And yet over 70 percent of the internet is held together by PHP solutions | 'The Internet' or 'the web'over | none (anonymous reader comment) | restates [S-014](#S-014) | 95d1565c5959 |

## What this does not show
- W3Techs does not publish what share of sites have a known server-side language, so its 69.3% cannot be turned into a share of all websites.
- The HTTP Archive shares are the desk's own division of two published counts (PHP origins over all origins, same date and client); the HTTP Archive does not publish the ratio.
- Every host count except the Censys query gist reaches the vault through a news outlet; no scanner's own publication is captured.
- The Internet Archive could not be reached from the desk's session; the history of wording rests on the vault's repeat captures, the pages' own modified dates and Wikipedia's revision history.
- The measurers' pages were fetched by the desk on 24 October and are not captured into a vault; they are shown with URL, time and sha256, and are not evidence of the story until captured (board 033, 043 and 222 ask the collectors for W3Techs).


---
site v0.14.6 · data as of 2026-10-23T16:04Z · vault commit 1845598d9a38 · https://php.oct.2026.newsroom.sgit.ai/factcheck/investigations/php-share/index.html