PHP2Shell services

Loading… CVE-2026-109618 · CVE-2026-109619

Exposure

Fixed releases: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Branches 8.1 and older receive no official release.

Where

Live from the Scanners

PHP responses Censys scanners receive per minute, by the version they report. Last 24 hours, smoothed; hover for 5-minute detail. Updated hourly.

–
PHP responses / min

Patch Progress

How the exposed population changes as fixes roll out. One bar per UTC day: today's bar updates hourly and becomes final at midnight UTC.

Services Patched

Services previously seen on an affected version, by the day a scan first saw them on a fixed version. Each upgrade happened between those two sightings.

Fix Adoption by Branch

How far each supported branch is from its fixed release: services on the fix, one release behind, 2–5 behind, and 6 or more behind. These branches can patch; 8.1 and older have no official fix.

By PHP Branch

Share of current PHP services per branch. Expand a row for its counts.

Networks

Most Common Versions

The 20 most common reported PHP versions and whether each is affected.

Notes & limitations