Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Fact · scale · reported
PHP is exposed on about 2.6 million internet-facing hosts, of which Censys counted 1.57 million unpatched on 21 October
Censys: 2.58 million hosts seen, 1.58 million reporting a version, 1.57 million not patched; nearly 3 million by 22 October. VirusTotal: 5.1 million IPs running PHP, 1.1 million announcing a version. Unit 42: 22.6 million systems that 'could be vulnerable' (via Insurance Business). Censys's own post was not found.
Fact-check
A2 Reported●●○○○○ measures differently · Count · verdict: holds in part
Both figures are carried, but only second hand: VulnCheck's 2,608,039 hosts via The Hacker News and SecurityWeek (one origin), and Censys's 2.58 million seen, 1.57 million unpatched via SecurityWeek alone; no scanner's own page or method is captured, so A2. 'Of which' wrongly makes Censys's 1.57 million a subset of VulnCheck's 2.6 million; it is a subset of Censys's own 2.58 million.
| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| thehackernews-php2shell-4days | carries | VulnCheck's analysis has identified PHP on 2,608,039 internet-facing hosts, out of which over 700,000 hosts run PHP 3.x through 7.3. | c1cb63141287484c |
| securityweek-exploitation-days-before | carries | roughly 1.58 million were reporting identifiable PHP versions, and approximately 1.57 million were not patched, Censys says. | ac663f2d9dbd0197 |
| securityweek-exploitation-days-before | carries | VulnCheck was seeing more than 2.6 million internet-facing hosts running PHP, nearly all of which were vulnerable. | ac663f2d9dbd0197 |
| insurancebusiness-uk-councils-met | carries | Palo Alto Networks’ Unit 42 has counted more than 22.6 million internet-facing systems that could be vulnerable. | 89357150e0bc8363 |
Open tickets: Contradiction-4, Finding-100, Finding-34.
Graded in Run-1, resting on captures up to 2026-10-22 11:23 UTC. The scale is on the fact-check page.
This fact over time
- 2026-10-22THN publishes Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed
- 2026-10-22SecurityWeek publishes PHP2Shell Exploitation Started Days Before Patches - SecurityWeek
- 2026-10-22 08:13 UTCSaved into the evidence vault: THN
- 2026-10-22 11:23 UTCSaved into the evidence vault: SecurityWeek
- 2026-10-22Enters this site as reported in v0.1.0 (reconstructed from git)
- 2026-10-22Reworded or re-sourced in v0.2.0 (reconstructed from git)
Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.
What it rests on
Where this fact appears
In the briefings for:
And on every claim.
Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · reported
PHP is exposed on 2,608,039 internet-facing hosts Who says it: VulnCheck, via The Hacker News Status: reported Topic: scale Sources: thehackernews-php2shell-4days