•
2 min read
Over 1.5 Million Internet-Exposed PHP Servers Remain Unpatched Against PHP2Shell on October 23
Telemetry on October 23, 2026 indicates that roughly 1.5 million internet-facing PHP hosts still lack patches for CVE-2026-109618 and CVE-2026-109619.