Researchers: PHP2Shell patching lags, 93.6% of servers still exposed

Five days after disclosure of the critical PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2), 93.6% of servers remain unpatched, Ox Security reported. Censys counted 32.5 million internet-facing services on vulnerable PHP versions, with 58% reporting no version at all, while Cloudflare logs millions of exploit attempts.

• Ox: five days after disclosure, 93.6% of servers remain exposed
• Censys: 32.5M services on vulnerable PHP, 58% report no version
• Mallory: about 73.5% of services run unsupported PHP versions
• CISA orders US federal agencies to remediate by October 29, 2026