How much of the web PHP2Shell touches

PHP2Shell reaches most of the web because it lives in PHP itself, not in any one app. Sansec reports the vulnerable code dates to PHP 5.4 in 2012 and default configurations are exposed, so the risk is the language's entire footprint.

Measure

Figure

Source

Websites with a known server language that run PHP

70–80%

Kinsta, via CyberScoop

Same measure, August 2026

70.2% (65.9% among the top 1 million sites)

W3Techs , top 1M

Websites running PHP

about 24 million

BuiltWith, via Computer Weekly

Internet-exposed instances potentially vulnerable

more than 22.6 million

Unit 42, via Malware News

Exposed hosts by Shodan search

about 1.9 million

CyberScoop

Exposed hosts, researcher estimate

more than 1.3 million

CyberScoop

Version-visible servers on unsupported PHP 5.4–8.1

about 758,000

VirusTotal

Version-visible servers on supported branches

about 272,000

VirusTotal

The counts differ because they measure different things: sites versus servers, detectable…