Research across more than 10,000 customers identifies 167 million PHP package installations, with 73% on internet-facing assets and more than 70% of installations running unsupported versions.
Qualys has made its security services available free for 15 days to help organisations identify and mitigate exposure to PHP2Shell, two critical PHP vulnerabilities that enable unauthenticated remote code execution. The offer covers up to 1,000 assets and includes tools to discover vulnerable systems, prioritise risks and verify remediation.
Tracked as CVE-2026-109618 and CVE-2026-109619, both vulnerabilities carry a CVSS v4.0 severity score of 9.2. Attack traffic has already been reported, while exposed PHP worker memory can reveal sensitive information, including passwords, authentication tokens and API keys.
Although PHP has released fixes for supported versions, the scale of legacy deployments presents a significant challenge. Qualys Threat Research Unit (TRU) analysis of anonymised data from more than 10,000 customers found 167 million PHP package installations, 73% of them on internet-facing assets.
Among the 156 million installations with a known version, approximately 110 million, or 71%, were running end-of-life or end-of-support releases spanning PHP 5.4 to 8.1. Most of these installations will not receive a vendor patch, making mitigation and eventual upgrades critical to reducing exposure.
“With attackers already moving, security teams need to know right now whether they are exposed and how to fix it immediately.” — Shailesh Athalye, Chief Product Solutions Officer, Qualys
Only 44 million installations in the analysis were running supported PHP branches from versions 8.2 to 8.5, for which fixes are available. The research also found that just 581,000 installations—0.37% of the total with known versions—had been patched within the first 24 hours after disclosure.
“With attackers already moving, security teams need to know right now whether they are exposed and how to fix it immediately,” said Shailesh Athalye, Chief Product Solutions Officer at Qualys. He said the company is making its services available to help organisations identify, prioritise and close exposures before attackers exploit them.
The free service brings together capabilities from the Qualys TruRisk Platform, including Qualys VMDR, Enterprise TruRisk Management and TruRisk Eliminate. According to the company, organisations can detect vulnerable PHP instances within 60 minutes, including those running in containers or bundled within other applications.
Security teams can then prioritise internet-facing systems, validate exposure in the context of existing controls and apply fixes to supported PHP versions. Remediation requires restarting PHP services for patches to take effect. For unsupported releases, organisations can use operating-system vendor backports where available, isolate vulnerable systems and plan upgrades or retirement. Rescanning helps confirm whether exposures have been closed.
The offer highlights a broader vulnerability-management problem: identifying a flaw is only the first step when large numbers of production systems depend on legacy software. Organisations must balance rapid risk reduction with the operational impact of upgrading applications, while ensuring that temporary mitigations do not become permanent substitutes for modernisation.
Organisations can access the assessment and activate the free 15-day service for up to 1,000 assets at qualys.com/php2shell-risk-assessment.
