I work at IPinfo, where we scan the IPv4 and IPv6 Internet. On October 22, the day after the fixed releases (8.5.12, 8.4.27, 8.3.36, 8.2.35), we started re-checking the same 1.46 million addresses that show a PHP version every day.

Where they started. In our October 14–15 scan, 1,105,160 addresses showed a PHP version. 409,494 of them (37%) ran 5.4–7.3, which is affected and gets no free official fix.

One week later. Of the servers that weren’t yet on a patched release on October 22:

• Live sites on 8.2–8.5: 36.5% patched on day one, 47.5% by October 28 (41,707 of 87,865). Almost everything happened on the first day.
• Default pages, panels and devices on 8.2–8.5: 23.0%.
• Live sites on 5.4–7.3: 0.95% moved to a patched release (1,249 of 131,024).

Among servers still showing a vulnerable version, 47% now run 7.3 or older. For comparison, Wiz reported 5.7% for its customers’ cloud machines. The open Internet has a much longer tail.

How we counted:

• Patched means the version string shows 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 or later, lowest version per address.
• We left out addresses that show PHP only on hosting control-panel ports (2082, 2083, 2086, 2087, 2095, 2096), and blocks where 64 or more addresses in a /24 (or /64) send the identical response. That’s one machine answering for many.
• “Live site” means the page looked like a site in use in our October 14–15 scan, not a default page, login panel or device.
• We dropped October 26 from the series. One large host’s proxy hid PHP versions on tens of thousands of servers for that day only.

Caveats:

• Some hosts (GoDaddy, cPanel’s EasyApache packages) and distributions backport fixes without changing the version number, and TuxCare sells patched builds for 5.x–8.1. So these numbers are minimums.
• We measure versions, not break-ins. CISA added PHP2Shell to its known-exploited list on October 26, but we can’t see who was attacked.

Happy to answer questions on the method. I write these up in a short brief: https://ipinfo.io/blog/internet-brief-1?utm_source=reddit_r_php&utm_medium=social&utm_campaign=php2shell