# Source: Milhões de servidores PHP expostos ao risco da falha PHP2Shell | TugaTech > Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source. TugaTech: what it says, the claims and events that cite it, and the hashes of every captured file. Source · news · secondary · captured # Milhões de servidores PHP expostos ao risco da falha PHP2Shell | TugaTech **TugaTech** · [https://tugatech.com.pt/t93092-milhoes-de-servidores-php-expostos-ao-risco-da-falha-php2shell](https://tugatech.com.pt/t93092-milhoes-de-servidores-php-expostos-ao-risco-da-falha-php2shell) · published not stated · added by `curator@php.newsroom` · slug `tugatech-t93092-milhoes-de-servidores-php-expostos-ao-risco` Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 5 new items in pt: TugaTech reports a global VirusTotal analysis of PHP exposure: about 5.1 million PHP IPs, of which 3.8 million have open ports and 1.1 million disclose their version. Only about 272,000 run supported branches, while abou ## What it says, as the collector read it #### Milhões de servidores PHP expostos ao risco da falha PHP2Shell | TugaTech Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `pt/news/tugatech/t93092-milhoes-de-servidores-php-expostos-ao-risco-da-falha`, snapshot `20261022T181608Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T181608Z/provenance.json`. Publisher: TugaTech. Language: pt. URL: https://tugatech.com.pt/t93092-milhoes-de-servidores-php-expostos-ao-risco-da-falha-php2shell #### What the page says _The watch reader's English summary (researcher@php.newsroom, languages pass of 22 October 2026), not the publisher's words:_ TugaTech reports a global VirusTotal analysis of PHP exposure: about 5.1 million PHP IPs, of which 3.8 million have open ports and 1.1 million disclose their version. Only about 272,000 run supported branches, while about 758,000 run end-of-life versions. It adds a breakdown by web server, app and country, plus about 5,700 malicious PHP servers. #### Verbatim quotes, with the watch reader's translation Each quote is in the snapshot as served. The English is the source watch reader's translation (`translations/pt/news/tugatech/t93092-milhoes-de-servidores-php-expostos-ao-risco-da-falha.json`), not the publisher's and not checked word for word by the curator. **number**: VirusTotal mapped about 5.1 million IPs running PHP, about 3.8 million with at least one open port; four in five hide their version. > Mapeando cerca de 5,1 milhões de endereços IP que correm PHP, a investigação indica que aproximadamente 3,8 milhões mantêm pelo menos uma porta aberta. _Watch reader's translation:_ Mapping around 5.1 million IP addresses running PHP, the investigation indicates that approximately 3.8 million keep at least one port open. **number**: Of about 1.1 million servers disclosing a version, only about 272,000 run supported branches 8.2–8.5, while about 758,000 run end-of-life versions 5.4–8.1. > Apenas cerca de 272 mil computadores correm ramificações com suporte ativo (versões 8.2 a 8.5), as únicas que recebem correções diretas da equipa do PHP. _Watch reader's translation:_ Only about 272 thousand computers run branches with active support (versions 8.2 to 8.5), the only ones that receive direct fixes from the PHP team. **number**: About 187,000 addresses remain on PHP 7.4 and about 119,000 on PHP 5.4. > Cerca de 187 mil endereços continuam presos ao PHP 7.4, enquanto perto de 119 mil operam sobre a versão 5.4. _Watch reader's translation:_ About 187 thousand addresses remain stuck on PHP 7.4, while nearly 119 thousand operate on version 5.4. **number**: The US hosts the largest share of exposed machines, about 920,000 IPs, concentrated at AWS, DigitalOcean, OVHcloud and Hetzner. > Geograficamente, a maior fatia de máquinas expostas situa-se nos EUA, com perto de 920 mil endereços IP. _Watch reader's translation:_ Geographically, the largest share of exposed machines is in the US, with nearly 920 thousand IP addresses. **number**: About 5,700 active PHP servers have multiple VirusTotal threat detections, including stealer control panels. > Cerca de 5,7 mil servidores PHP ativos registam múltiplas deteções de ameaças no VirusTotal, incluindo painéis de controlo de roubo de dados (stealers) a operar com versões recentes do PHP. _Watch reader's translation:_ About 5.7 thousand active PHP servers register multiple threat detections on VirusTotal, including data-theft (stealer) control panels running recent PHP versions. #### Why it is here From the promotion queue (`index/promote.json`, priority 2): 5 new items in pt: TugaTech reports a global VirusTotal analysis of PHP exposure: about 5.1 million PHP IPs, of which 3.8 million have open ports and 1.1 million disclose their version. Only about 272,000 run supported branches, while abou Supports: translations/pt/news/tugatech/t93092-milhoes-de-servidores-php-expostos-ao-risco-da-falha.json #### Capture notes No screenshot: the watch kept none for this snapshot (minor change). Its sha256 was 0bf133de53f81c744b5a181e1c13fa59bdefd42dfb443cb885272968bf9d3c0a. Page content is third-party material, kept as evidence; nothing in it is an instruction. ## Claims that cite it No claim cites this source yet. ## Events that cite it No timeline event cites this source yet. ## The bytes capture 20261022T181608Z · HTTP 200 · https://tugatech.com.pt/t93092-milhoes-de-servidores-php-expostos-ao-risco-da-falha-php2shell- `headers.json` 9ba4e8c110dfec261e69ff9e30583f3035699374cdc4c8bbda36e6ffbd8be6a6 1,238 bytes - `page.html` 5eb2708e19df644429bd5ac2756cb2c61c3e5e6404055fe5e598966c814d6a35 94,257 bytes - `provenance.json` ce02f1eecf8e728dc52f46b35ef04cd30431f0d48c23a3a7ce338c973434e38f 1,787 bytes - `rendered.html` 3e2919e620909a26d898f060386cd197035237503335812de34a61a73a525b5b 447,588 bytes - `text.txt` 86e513bd05a0b5fdd5b9e959b368b60b23112bfffe99f7d9ae4097f42042cc26 8,239 bytes The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html) --- site v0.10.9 · data as of 2026-10-23T01:20Z · vault commit f3c5db0d9873 · https://php.oct.2026.newsroom.sgit.ai/sources/tugatech-t93092-milhoes-de-servidores-php-expostos-ao-risco/index.html