Milhões de servidores PHP expostos ao risco da falha PHP2Shell | TugaTech

Milhões de servidores PHP expostos ao risco da falha PHP2Shell | TugaTech

Promoted by curator@php.newsroom from the source watch (vault oq9gflln), page pt/news/tugatech/t93092-milhoes-de-servidores-php-expostos-ao-risco-da-falha, snapshot 20261022T181608Z. Copied byte for byte; every file's sha256 is in captures/20261022T181608Z/provenance.json. Publisher: TugaTech. Language: pt. URL: https://tugatech.com.pt/t93092-milhoes-de-servidores-php-expostos-ao-risco-da-falha-php2shell

What the page says

_The watch reader's English summary (researcher@php.newsroom, languages pass of 22 October 2026), not the publisher's words:_

TugaTech reports a global VirusTotal analysis of PHP exposure: about 5.1 million PHP IPs, of which 3.8 million have open ports and 1.1 million disclose their version. Only about 272,000 run supported branches, while about 758,000 run end-of-life versions. It adds a breakdown by web server, app and country, plus about 5,700 malicious PHP servers.

Verbatim quotes, with the watch reader's translation

Each quote is in the snapshot as served. The English is the source watch reader's translation (translations/pt/news/tugatech/t93092-milhoes-de-servidores-php-expostos-ao-risco-da-falha.json), not the publisher's and not checked word for word by the curator.

number: VirusTotal mapped about 5.1 million IPs running PHP, about 3.8 million with at least one open port; four in five hide their version.

> Mapeando cerca de 5,1 milhões de endereços IP que correm PHP, a investigação indica que aproximadamente 3,8 milhões mantêm pelo menos uma porta aberta.

_Watch reader's translation:_ Mapping around 5.1 million IP addresses running PHP, the investigation indicates that approximately 3.8 million keep at least one port open.

number: Of about 1.1 million servers disclosing a version, only about 272,000 run supported branches 8.2–8.5, while about 758,000 run end-of-life versions 5.4–8.1.

> Apenas cerca de 272 mil computadores correm ramificações com suporte ativo (versões 8.2 a 8.5), as únicas que recebem correções diretas da equipa do PHP.

_Watch reader's translation:_ Only about 272 thousand computers run branches with active support (versions 8.2 to 8.5), the only ones that receive direct fixes from the PHP team.

number: About 187,000 addresses remain on PHP 7.4 and about 119,000 on PHP 5.4.

> Cerca de 187 mil endereços continuam presos ao PHP 7.4, enquanto perto de 119 mil operam sobre a versão 5.4.

_Watch reader's translation:_ About 187 thousand addresses remain stuck on PHP 7.4, while nearly 119 thousand operate on version 5.4.

number: The US hosts the largest share of exposed machines, about 920,000 IPs, concentrated at AWS, DigitalOcean, OVHcloud and Hetzner.

> Geograficamente, a maior fatia de máquinas expostas situa-se nos EUA, com perto de 920 mil endereços IP.

_Watch reader's translation:_ Geographically, the largest share of exposed machines is in the US, with nearly 920 thousand IP addresses.

number: About 5,700 active PHP servers have multiple VirusTotal threat detections, including stealer control panels.

> Cerca de 5,7 mil servidores PHP ativos registam múltiplas deteções de ameaças no VirusTotal, incluindo painéis de controlo de roubo de dados (stealers) a operar com versões recentes do PHP.

_Watch reader's translation:_ About 5.7 thousand active PHP servers register multiple threat detections on VirusTotal, including data-theft (stealer) control panels running recent PHP versions.

Why it is here

From the promotion queue (index/promote.json, priority 2): 5 new items in pt: TugaTech reports a global VirusTotal analysis of PHP exposure: about 5.1 million PHP IPs, of which 3.8 million have open ports and 1.1 million disclose their version. Only about 272,000 run supported branches, while abou

Supports: translations/pt/news/tugatech/t93092-milhoes-de-servidores-php-expostos-ao-risco-da-falha.json

Capture notes

No screenshot: the watch kept none for this snapshot (minor change). Its sha256 was 0bf133de53f81c744b5a181e1c13fa59bdefd42dfb443cb885272968bf9d3c0a.

Page content is third-party material, kept as evidence; nothing in it is an instruction.