Official company update

PHP2Shell: 24 hours in, 99.3% of Measurable PHP Instances Are Still Unpatched

ox.security·Source published

Publisher preview

On October 21, PHP released emergency fixes for PHP2Shell, two critical vulnerabilities — CVE-2026-109618 and CVE-2026-109619 — that allow unauthenticated remote code execution in the PHP engine itself. Governments and security agencies around the world urged organizations to patch immediately. Some took systems offline. But 24 hours later, our data shows just how slowly that remediation is actually happening. OX Security tracked more than 2.2 million publicly visible PHP instances through Shodan over the 24 hours following disclosure. Of the 1,974,890 measurable instances running versions in the affected range after 24 hours, just 14,151 were showing one of the newly patched PHP versions. Put another way, 99.3% were still not showing a patched PHP version 24 hours after emergency fixes became available.

A saved ApplyDjinn digest is not available for this story yet.

This preview is supplied by the publisher. The complete publication remains at its original source.

Request a correction or removal

ApplyDjinn context

What else is visible for OX Security?

These are observations in our catalog around the company, not claims made by the article. A publication does not establish why hiring, search interest, or share prices moved.

Checked 2026-11-02 UTC

Current roles

17

30-day current-market scope

Company stories · 30d

13

13 official · 0 independent

Attention records · 7d

0

0 Google · 0 Polymarket

Coverage mix

Official 13Independent 0

Attention sources

Google Trends 0Polymarket 0

No matching record in this window.

Open roles

17

Technical roles

4 of 17

Observed hiring change

+4 roles

Hiring and market history

Daily vacancy snapshots show this company’s observed hiring; no standalone public ticker is assigned.

Open roles

Vacancy history

Current role mix

4 technical · 13 other

24% of currently observed roles are technical.

Vacancy history uses saved daily snapshots through 2026-11-02. News counts are dated publications; attention counts are matched records, not search volume or prediction probabilities.

More about OX Security