56 million PHP fingerprints do not mean vulnerable hosts

A ZoomEye analysis returned 56.8 million matches for app="PHP" and 5.5 million for app="Node.js", but these are runtime-presence fingerprints, not vulnerable versions. Amid PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2), such counts cannot estimate how many systems are exploitable.

• app="PHP" query returned 56,809,811 matches; app="Node.js" returned 5,522,163
• The http.header.server="Node.js" query returned only 155 matches
• PHP2Shell: CVE-2026-109618 and CVE-2026-109619 rated 9.2
• Fixes shipped in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35