Two and a Half Million Hosts Still Advertise PHP 7.4

After the PHP2Shell disclosure in October 2026, the useful question stopped being "how many servers run PHP" and became "how many run a version that will never receive a fix". The index answers that more directly than most people expect, because a surprising number of servers still volunteer their version in a response header.

What the header reveals

Queries against the ZoomEye index on 28 October 2026:

app="PHP" returns 111,072,293 matches, and app="PHP" && port=443 returns 22,706,573.

http.header="X-Powered-By: PHP" returns 46,709,646.

http.header="X-Powered-By: PHP/7.4" returns 2,650,830.

http.header="X-Powered-By: PHP/8.1" returns 530,860.

http.header="X-Powered-By: PHP/8.2" returns 796,916. The version-specific counts are the most interesting numbers here, and they invert the intuition. PHP 7.4 and 8.1 are end-of-life branches. PHP 8.2 is a supported branch that received a fix.…