In short: How many servers are affected by PHP2Shell can only be estimated. According to TechTarget, Unit 42 counted more than 22.6 million exposed instances, CybelAngel cites around 2.24 million PHP hosts, and BleepingComputer, citing VirusTotal, reports over 5.1 million. The figures measure different things and therefore do not contradict each other. For your company, a different figure counts: how many of your own PHP systems are reachable and how many of them are demonstrably patched.
The trigger: one figure makes headlines
"22 million servers at risk" appeared in many headlines on 21 October 2026. The figure comes from Unit 42, the research arm of Palo Alto Networks, and was reported by TechTarget, among others. Shortly afterwards, other figures circulated, some smaller by a factor of ten.
Readers get the impression that nobody knows what is going on. In fact, the vendors simply count different things with different methods. Anyone who understands this can use the figures instead of being unsettled by them.
How many servers are affected by PHP2Shell? The figures at a glance
| Source | Figure | What was counted |
|---|---|---|
| Unit 42 (Palo Alto Networks), according to TechTarget | more than 22.6 million | exposed, potentially vulnerable instances; method not explained in the report |
| VirusTotal, according to BleepingComputer | over 5.1 million | internet-reachable PHP hosts |
| CybelAngel, based on Shodan data | around 2.24 million | hosts that identify PHP in their banners |
| CybelAngel | 59% of around 1.5 million | share of hosts with a visible version on branches without an official update |
| CybelAngel | around 740,000 | hosts that identify PHP but hide their version |
All figures refer to the situation around 20 and 21 October. They are snapshots and change with every update that is installed.
Why the counts are so far apart
Three effects explain most of the differences.
Instance, host, website. A host is usually an IP address or a server. An instance can be a single service or a single website. On a server in shared hosting, hundreds of websites often run. CybelAngel itself points this out: hosts are counted, not organisations or websites, and the actual number of reachable applications is probably higher.
Hidden versions. Many servers do not reveal their PHP version, for example because expose_php is switched off. They are missing from version-based statistics. Why hiding it makes sense but does not replace protection is explained in the article on version information and expose_php.
Backports. Distributions and hosting providers sometimes install fixes without changing the version number. A server that shows an old number to the outside can therefore be patched. Counts based on the displayed version therefore overestimate the number of unpatched systems. How to check the real status on your own systems is described under Checking the PHP version and patch level.
How such counts come about
Most figures are based on search services that continuously query the internet and store what servers disclose about themselves. A web server often names software and version in its responses, for example in the X-Powered-By header. According to its own account, CybelAngel relies on such banners from Shodan data. Nothing is attacked in the process; what is read is only what is publicly visible anyway.
A simple reading rule follows for every new figure in the media. Ask: what was counted, hosts, instances or websites? When was it measured, before or after 21 October? And how was the version determined, via the displayed number or via a real test? Anyone who cannot answer these three questions should treat the figure as a rough order of magnitude, not as a measured value.
"Exposed" means reachable and, judging by external characteristics, possibly vulnerable. It does not mean attacked and not compromised. The BSI initially knew of no confirmed successful attacks on a broad scale.
What the figures reliably show anyway
Even if the level fluctuates, the counts support three robust statements:
- The attack surface is huge. Even the smallest figure means millions of reachable targets. Attackers do not have to search; they can check automatically.
- Old versions are widespread. According to CybelAngel, 59 percent of hosts with a visible version ran on branches for which the PHP project does not publish an official update. For these systems, a quick patch does not help; only a backport, a third-party provider or a migration does. The risks are described in the guide PHP end of life.
- The problem will last longer. A large part of the reachable systems will not be updated within days. Scans and attack attempts are therefore likely to continue for a long time.
Determining your own figure
The worldwide figure is a headline. Your own is a task. Here is how to arrive at it:
- Collect domains and subdomains: from DNS zones, certificates, and contracts with agencies and hosting providers.
- Assign reachable services: Which server is behind which address, and who operates it?
- Record the PHP status for each system: version, operating mode, package source, backport confirmation.
- Assess the result: patched and documented, patched without proof, unpatched, unknown.
- Close the gaps: clarify the unknown first, act on the unpatched first.
What you end up with is a short list instead of a big number. How to maintain the inventory permanently is described in the article Inventory of all websites and servers.
How does PHP SOS help?
- Outside view: We determine which of your systems are reachable from the internet and which of them use PHP.
- Inside view: We check the patch level and restart on the servers, not just the displayed version.
- Assessment: You receive a list with the status of each system and a clear order of priority.
- Verification: On request, after the patch we test from outside whether the situation has improved as expected.
How such a check works is described under Security audit and penetration test.
Conclusion
22.6 million, 5.1 million, 2.24 million: the figures seem contradictory but only measure different things. Together they show that PHP2Shell affects a very large attack surface and that many old versions are online. The figure that decides your risk is not provided by any study. It arises only from looking at your own systems.
Frequently asked questions
How many servers are affected by PHP2Shell?
Nobody knows exactly. According to TechTarget, Unit 42 from Palo Alto Networks counted more than 22.6 million exposed, potentially vulnerable instances. CybelAngel cites around 2.24 million internet-reachable hosts that identify PHP. The figures measure different things and are not directly comparable.
Why do the figures differ so much?
Because different things are counted: instances, hosts, IP addresses or services. A shared hosting host can carry hundreds of websites. In addition, many servers do not display their PHP version, while others show an old number even though a backport has been installed.
Does exposed mean that a server was attacked?
No. Exposed only means that a PHP service is reachable from the internet and, judging by external characteristics, could be vulnerable. These counts say nothing about actual attacks.
Which figure matters for my company?
The number of your own publicly reachable PHP systems and how many of them are demonstrably patched. The worldwide figures show the scale but do not replace your own inventory.