PHP Statistics 2026
By Axis Intelligence Research
Co-author: Marcus Chen | Last updated: October 23, 2026 | License: CC BY 4.0
PHP runs 69.3% of websites whose server-side language is known (W3Techs, October 23, 2026). Axis Intelligence Research calculates that 48.3% of those PHP websites, and 73.5% of internet-facing PHP services, run a branch that received no official fix for the PHP2Shell vulnerabilities patched on October 21, 2026.
Quick Answer
PHP is still the web’s dominant server-side language at 69.3% of sites with a known language, 8.6 times JavaScript’s 8.1% (W3Techs, October 2026). The problem in late 2026 is age, not share. Axis Intelligence Research’s End-of-Life Branch Reach (EBR™) puts 48.3% of PHP websites on PHP 8.1 or older, the branches PHP stopped patching. When PHP 8.2 loses security support on December 31, 2026, that share rises to 66.4% unless sites migrate.
Key Findings
- Axis Intelligence Research calculates that 48.3% of PHP websites ran an end-of-life PHP branch on October 23, 2026, based on W3Techs version data.
- Axis Intelligence Research finds 1,925,107 internet-facing PHP services on PHP 8.1 or older, 73.5% of the 2,618,284 that report a version, using Mallory’s October 21, 2026 Shodan recount.
- The widely quoted figure of 883,717 exposed hosts undercounts the corrected October 21 total by 1,041,390 services, according to Axis Intelligence Research’s comparison of Mallory’s two published counts.
- Axis Intelligence Research projects that 66.4% of PHP websites will run an unsupported branch on January 1, 2027, when PHP 8.2 reaches end of life, if the October 2026 version mix holds.
- Amazon Threat Intelligence logged a PHP2Shell exploit attempt on October 17, 2026, four days before PHP published fixes for CVE-2026-109618 and CVE-2026-109619.
What Happened With PHP2Shell, and Why Do These PHP Statistics Matter Now?
On October 21, 2026, the PHP project shipped PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two remote code execution flaws in the interpreter itself. Both CVE-2026-109618 (out-of-memory corruption) and CVE-2026-109619 (stale global state) are rated 9.2 under CVSS v4.0, according to the PHP security advisory. The pair became known as PHP2Shell.
Two facts make this the defining PHP event of 2026. The flaws sit in the runtime, so every application on top of it inherits them: WordPress, Laravel, Drupal, Magento, custom code. And PHP fixed only the four branches it still supports. PHP 8.1 and older received source-only backports for 7.4, 8.0 and 8.1, not packaged releases.
A third detail arrived on October 23. PHP published an informational advisory for CVE-2026-115560, a related session-upload-progress issue it rates as unlikely in practice, and recommended keeping session.upload_progress.enabled=0 until the next regular release.
PHP2Shell Timeline, July to October 2026
| Date (UTC) | Event | Source |
|---|---|---|
| Jul 30, 2026 | Calif begins an audit of PHP under OpenAI’s Patch the Planet program | The PHP Foundation |
| Aug 11, 2026 | Calif reports an unconditional remote code execution with the same root cause as a 2024 out-of-memory finding | The PHP Foundation |
| Aug 24, 2026 | Wiz reports further attack vectors | The PHP Foundation |
| Sep 18, 2026 | OpenAI reports further attack vectors | The PHP Foundation |
| Oct 17, 2026 | First PHP2Shell exploit attempt hits Amazon’s MadPot honeypots | Amazon Threat Intelligence |
| Oct 20, ~15:00 | CVE IDs leak online with an incorrect CVSS score of 10.0 | The PHP Foundation |
| Oct 20, 19:30 | PHP pre-announces the release and moves it from Oct 22 to Oct 21 | The PHP Foundation |
| Oct 21, ~02:00 | Earliest proof-of-concept exploit attempts seen by Amazon | Amazon Threat Intelligence |
| Oct 21, 03:02 | Cloudflare WAF protection goes live for all WAF customers | Cloudflare |
| Oct 21, 07:41 | Chainguard publishes fixed images, breaking the embargo | The PHP Foundation |
| Oct 21, 14:00 | PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 released | The PHP Group |
| Oct 23, 2026 | Informational advisory for CVE-2026-115560 | The PHP Group |
Axis Intelligence Research counts 71 days between Calif’s August 11 report and the October 21 release, and roughly 23 hours between the CVE leak and the fix. The PHP Foundation’s account calls the earlier stall a structural failure of decision process and resources, and notes the security team has published 15 CVEs since July 1, 2026 while working through more than 100 invalid or duplicate reports.
Marcus Chen’s read: Strip out the leak drama and the sequence is ordinary. A memory-handling bug was theorized in 2024, nobody had a clean exploit path, and the fix kept losing to more urgent work. AI-assisted research then produced three independent exploit routes in five weeks. That compression is the real news. The disclosure window that used to give maintainers a quarter now gives them a few weeks, and the deployment base still moves on a multi-year clock.
What Percentage of Websites Use PHP in 2026?
PHP is used by 69.3% of all websites whose server-side programming language W3Techs can identify, as of October 23, 2026. No other language comes close.
| Server-side language | Share of websites with a known language | Date | Source |
|---|---|---|---|
| PHP | 69.3% | Oct 23, 2026 | W3Techs |
| JavaScript | 8.1% | Oct 22, 2026 | W3Techs |
| Ruby | 7.1% | Oct 22, 2026 | W3Techs |
| Java | 5.4% | Oct 22, 2026 | W3Techs |
| ASP.NET | 4.2% | Oct 22, 2026 | W3Techs |
| Python | 1.1% | Oct 22, 2026 | W3Techs |
Axis Intelligence Research calculates PHP’s footprint at 8.6 times JavaScript’s (69.3 ÷ 8.1). W3Techs recorded JavaScript overtaking Ruby for second place on July 27, 2026. A website can use more than one language, so these shares do not sum to 100%.
Survey lenses tell a smaller story. In the 2025 Stack Overflow Developer Survey, 18.9% of all respondents and 19.1% of professional developers did extensive work in PHP. TIOBE’s October 2026 index ranks PHP 12th at 1.26%, up from 14th a year earlier. Our programming language statistics compare those lenses across languages.
Marcus Chen’s read: The gap between 69.3% of sites and 19% of developers is the whole security story in one ratio. A few developers ship code that runs on a very large number of servers, and most of those servers are maintained by nobody in particular. Shared hosting, agency handoffs, appliances with a web UI. That is where unpatched runtimes accumulate.
Which PHP Versions Are Most Used in 2026?
PHP 8 runs on 65.3% of PHP websites, PHP 7 on 26.9%, PHP 5 on 7.7% and PHP 4 on 0.1%, according to W3Techs on October 23, 2026. PHP 8.3 is the single most common minor version.
PHP Version Share of All PHP Websites, October 2026
| PHP version | Share of PHP websites | Support status (Oct 23, 2026) | Source |
|---|---|---|---|
| 8.3 | 22.8% | Security fixes until Dec 31, 2027 | Axis calc. from W3Techs |
| 7.4 | 19.7% | End of life | Axis calc. from W3Techs |
| 8.2 | 18.0% | Security fixes until Dec 31, 2026 | Axis calc. from W3Techs |
| 8.1 | 9.9% | End of life | Axis calc. from W3Techs |
| 8.4 | 7.9% | Active support until Dec 31, 2026 | Axis calc. from W3Techs |
| PHP 5 (all) | 7.7% | End of life | W3Techs |
| 8.0 | 3.8% | End of life | Axis calc. from W3Techs |
| 8.5 | 2.9% | Active support until Dec 31, 2027 | Axis calc. from W3Techs |
Minor-version shares = W3Techs major-version share × W3Techs share within that major version. Example: PHP 8.2 = 65.3% × 27.6% = 18.0%. Support dates from PHP’s Supported Versions page.
PHP 7.4, which PHP stopped supporting in 2022, is the second most common PHP release on the web at 19.7% of PHP websites (26.9% × 73.4%). It runs on more PHP sites than PHP 8.4 and 8.5 combined.
How Fast Do Developers Adopt New PHP Versions?
Developers move much faster than websites. Packagist’s Composer install data, analyzed by Brent Roose, shows PHP 8.4 leading with 32% of installs on July 1, 2026, and PHP 8.5 at 16% six months after release.
| PHP version | Jan 1, 2025 | Jun 1, 2025 | Jan 1, 2026 | Jul 1, 2026 | Source |
|---|---|---|---|---|---|
| 8.4 | 5% | 14% | 27% | 32% | stitcher.io (Packagist data) |
| 8.3 | 33% | 34% | 30% | 24% | stitcher.io (Packagist data) |
| 8.5 | — | 0% | 5% | 16% | stitcher.io (Packagist data) |
| 8.2 | 29% | 25% | 20% | 14% | stitcher.io (Packagist data) |
| 8.1 | 18% | 13% | 8% | 5% | stitcher.io (Packagist data) |
| 7.4 | 8% | 7% | 5% | 5% | stitcher.io (Packagist data) |
| 8.0 | 3% | 3% | 2% | 1% | stitcher.io (Packagist data) |
Axis Intelligence Research calculates that PHP 8.4’s share of Composer installs (32%) is about four times its share of PHP websites (7.9%). The two populations differ: Composer counts developer and CI machines, W3Techs counts production sites. That difference is the point. Code gets written on new PHP and deployed onto old PHP.
The package ecosystem is not pulling deployments forward either. Of the 1,000 most popular Packagist packages, only 352 required a PHP version still receiving security updates on July 1, 2026, and only 113 required an actively supported version.
How Much of PHP Runs on End-of-Life Versions? The End-of-Life Branch Reach (EBR™)
The End-of-Life Branch Reach (EBR™) is an Axis Intelligence Research metric that measures the share of a PHP population running a branch the PHP project no longer patches. As of October 2026, that means PHP 8.1 and older, the exact set that received no packaged PHP2Shell fix.
Formula: EBR = share of the population on PHP 4.x, 5.x, 7.x, 8.0 or 8.1. Each lens is computed from its own primary source, without blending populations.
EBR™ Readings by Lens
| Lens | What it counts | EBR™ | As of | Inputs | Source |
|---|---|---|---|---|---|
| Developer machines | Composer installs | at least 11% | Jul 1, 2026 | 7.4 (5%) + 8.0 (1%) + 8.1 (5%) | Packagist via stitcher.io |
| Websites | Sites with a detected PHP version | 48.3% | Oct 23, 2026 | 26.9 + 7.7 + 0.1 + 65.3 × (5.8 + 15.1)/100 | W3Techs |
| Internet services | IP:port pairs reporting a PHP version | 73.5% | Oct 21, 2026 | 1,925,107 ÷ 2,618,284 | Mallory (Shodan) |
The developer reading is a floor: the source table lists PHP 7.4 and newer only.
The three readings form a gradient. The further you move from the developer’s laptop toward the open internet, the older the PHP. Axis Intelligence Research expresses that gradient as the Legacy Gradient Multiple (LGM): internet-service EBR divided by website EBR. LGM = 73.5 ÷ 48.3 = 1.52. Internet-facing services are about one and a half times as likely as indexed websites to run end-of-life PHP.
Applied to the whole web, website EBR means that about one in three websites with a known server-side language, 33.5%, runs an end-of-life PHP branch (69.3% × 48.3%).
Marcus Chen’s read: The three lenses are not disagreeing. They are measuring different layers of the same estate. W3Techs samples ranked websites, which skews toward maintained sites. Shodan sees every listening port, including the admin panel nobody remembers, the NAS on a home connection, the firewall UI. The LGM of 1.52 is a rough measure of how much legacy hides below the websites people actually visit. For incident response, the services lens is the one attackers use.
How Many Servers Are Exposed to PHP2Shell?
Mallory counted 2,618,284 internet-facing services reporting a PHP version on October 21, 2026. Of those, 1,925,107 (73.5%) run PHP 8.1 or older, for which PHP released no packaged fix.
| PHP branch group | Internet-facing services | Share of versioned services | PHP fix status | Source |
|---|---|---|---|---|
| PHP 4.x to 5.1 | 57,002 | 2.2% | None | Mallory |
| PHP 5.2 to 5.6 | 797,060 | 30.4% | None | Mallory |
| PHP 7.x | 857,707 | 32.8% | Source-only fix for 7.4 | Mallory |
| PHP 8.0 and 8.1 | 213,338 | 8.1% | Source-only fix | Mallory |
| PHP 8.2 to 8.5 | 693,177 | 26.5% | Released Oct 21, 2026 | Mallory |
Axis Intelligence Research calculates that 32.6% of versioned internet-facing PHP services still run PHP 5.6 or older. PHP 7.4 alone accounts for about 411,000 services, and 225,173 of them run 7.4.33, its final release.
Why the 884,000 Figure Is Out of Date
Most coverage of PHP2Shell cites “about 884,000 hosts, 59%.” That number came from Mallory’s first count on October 20, 2026 (883,717 hosts). On October 21, Mallory published a correction: one query per branch had undercounted older versions, and a recount by exact version put the end-of-life share at 73.5%.
Axis Intelligence Research calculates the difference at 1,041,390 services (1,925,107 − 883,717). The counting unit also changed from hosts to services, so the two figures are not a strict like-for-like series. Mallory’s corrected figure is the one to cite. A second scanner, Netlas, independently put the end-of-life share at 75.9% on its own September 29 index.
Apache mod_php and Hidden Exposure
PHP rates Apache with mod_php as the highest-risk setup. Mallory counted at least 565,000 internet-facing mod_php services, and 83% of those identifiable only through the Apache Server header run PHP 8.1 or older. Debian and Ubuntu hide that header by default, so the real count is higher.
Banner counts also miss software that bundles its own PHP. On October 21, Mallory’s Shodan queries found about 95,000 Nextcloud, 76,000 pfSense, 68,000 Coolify, 65,000 phpMyAdmin, 62,000 XAMPP, 47,000 HestiaCP, 20,700 OPNsense and 10,000 FreePBX web interfaces exposed to the internet.
Marcus Chen’s read: The unglamorous entry point here is the appliance. A firewall’s management page or a NAS dashboard ships its own PHP, and the operating system update does not touch it. Mallory looked for vendor software bills of materials (SBOMs) across 223 products and found none for roughly three in four. Of 39 SBOM files it could download, 32 did not list a PHP interpreter at all. If your asset inventory is built from SBOMs, PHP2Shell is invisible to it.
How Fast Are Servers Patching PHP2Shell?
Slowly, at least as banners show it. About eight hours after release, at 21:42 UTC on October 21, Mallory saw a fixed version on 2,149 of roughly 606,000 services reporting PHP 8.2 to 8.5, which is 0.36%.
That figure lags reality. Shodan re-scans gradually, and distributions such as Debian, Ubuntu and Red Hat backport fixes without changing the version string. It still sets a useful baseline. Patch uptake on the branches that can be patched started near zero while exploitation attempts were already running.
Will My Scanner Catch It?
Probably not. In Mallory’s October 21 test, Dependabot and composer audit returned nothing, because the advisories live on the php-src repository rather than in package advisory databases. Trivy gave identical results for the vulnerable php:8.3.35-apache and fixed php:8.3.36-apache Docker images. Debian and Ubuntu packages were flagged, because their security trackers list the CVEs.
Is PHP2Shell Being Exploited?
Exploitation attempts are confirmed. Confirmed compromises had not been publicly reported as of October 23, 2026.
| Observation | Date | Source |
|---|---|---|
| First exploit attempt against MadPot honeypots, from a commercial anonymization network | Oct 17, 2026 | Amazon Threat Intelligence |
| Earliest proof-of-concept exploit attempts, then more from varied infrastructure until 08:00 UTC | Oct 21, ~02:00 UTC | Amazon Threat Intelligence |
| WAF protection live for all plans, about 9 hours before disclosure | Oct 21, 03:02 UTC | Cloudflare |
| Attack traffic against customers, with payloads mutated to evade rules | Oct 21 | Cloudflare |
| No active exploitation identified by the Cyber Centre | Oct 21 (updated Oct 23) | Canadian Centre for Cyber Security |
| Neither CVE listed in CISA’s Known Exploited Vulnerabilities catalog | Oct 22 | watchTowr |
Amazon published six IP addresses tied to the activity and advised investigating from at least October 17 rather than from the disclosure date. Cloudflare deployed seven rules in its free managed ruleset and seven in its paid ruleset. Our KEV tracker will record the CVEs if CISA adds them.
Marcus Chen’s read: “Attempts” and “compromises” are different counts, and the gap between them is where most headlines went wrong this week. What the data supports is narrower and more useful. Someone had a working idea four days early, many actors had working code within hours of the patch, and nobody has yet published a confirmed breach. When confirmed incidents do surface, expect them in incident-response reports and breach notifications, not in WAF dashboards. Start log reviews from October 17, as Amazon advises.
Which Countries and Hosting Providers Run the Most End-of-Life PHP?
Of the 18 largest PHP-hosting countries below, 16 have a majority of their versioned PHP services on end-of-life branches; only the Netherlands and Denmark do not, according to Mallory’s October 21, 2026 counts.
End-of-Life PHP Services by Country
| Country | Versioned PHP services | On PHP 8.1 or older | Share | Source |
|---|---|---|---|---|
| United States | 699,282 | 494,910 | 71% | Mallory |
| China | 196,192 | 172,422 | 88% | Mallory |
| Japan | 180,514 | 142,232 | 79% | Mallory |
| Germany | 175,443 | 100,805 | 57% | Mallory |
| Netherlands | 83,275 | 38,683 | 46% | Mallory |
| France | 78,086 | 53,871 | 69% | Mallory |
| Indonesia | 73,735 | 49,902 | 68% | Mallory |
| Hong Kong | 72,081 | 59,725 | 83% | Mallory |
| India | 64,429 | 45,672 | 71% | Mallory |
| United Kingdom | 62,339 | 43,331 | 70% | Mallory |
| Italy | 61,386 | 55,433 | 90% | Mallory |
| South Korea | 56,423 | 50,104 | 89% | Mallory |
| Brazil | 55,379 | 43,054 | 78% | Mallory |
| Singapore | 52,765 | 40,726 | 77% | Mallory |
| Canada | 50,528 | 40,340 | 80% | Mallory |
| Australia | 35,338 | 27,834 | 79% | Mallory |
| Algeria | 32,418 | 32,398 | 99.9% | Mallory |
| Denmark | 24,693 | 5,365 | 22% | Mallory |
The United States holds 25.7% of all end-of-life PHP services worldwide (494,910 of 1,925,107, Axis Intelligence Research calculation). Of the 73 countries with at least 1,000 versioned services, 35 are at 80% or higher.
End-of-Life PHP Services by Hosting Provider
| Provider | Versioned PHP services | On PHP 8.1 or older | Share | Source |
|---|---|---|---|---|
| Amazon | 407,170 | 327,547 | 80% | Mallory |
| Hostinger | 139,557 | 41,394 | 30% | Mallory |
| Alibaba Cloud | 110,728 | 105,549 | 95% | Mallory |
| OVH | 62,020 | 41,503 | 67% | Mallory |
| Hetzner | 58,611 | 31,420 | 54% | Mallory |
| DigitalOcean | 52,885 | 37,180 | 70% | Mallory |
| Cogent | 35,510 | 30,091 | 85% | Mallory |
| Telecom Algeria | 28,105 | 28,105 | 100% | Mallory |
| 25,199 | 19,064 | 76% | Mallory | |
| Microsoft | 24,610 | 19,054 | 77% | Mallory |
Axis Intelligence Research calculates that these ten networks host 35.4% of all end-of-life PHP services, and Amazon’s networks alone host 17.0%.
Marcus Chen’s read: Hostinger’s 30% is the outlier worth studying. Managed shared hosting pushes customers forward on PHP versions because the host owns the runtime. Self-managed cloud instances do the opposite: the customer owns it, and many customers forgot they did. Provider-side defaults decide more of this map than any advisory will.
What Happens When PHP 8.2 Reaches End of Life on December 31, 2026?
PHP 8.2 receives its last security fixes on December 31, 2026, 69 days after this page’s snapshot. Every PHP 8.2 site then joins the end-of-life population.
PHP Branch Support Calendar
| Branch | Initial release | Active support until | Security support until | Source |
|---|---|---|---|---|
| 8.2 | Dec 8, 2022 | Dec 31, 2024 | Dec 31, 2026 | PHP Supported Versions |
| 8.3 | Nov 23, 2023 | Dec 31, 2025 | Dec 31, 2027 | PHP Supported Versions |
| 8.4 | Nov 21, 2024 | Dec 31, 2026 | Dec 31, 2028 | PHP Supported Versions |
| 8.5 | Nov 20, 2025 | Dec 31, 2027 | Dec 31, 2029 | PHP Supported Versions |
Each branch gets two years of active support and two years of security-only fixes. PHP 8.6 reached its fourth release candidate on October 21, 2026, with a final candidate planned for November 5.
The Year-End Cliff (YEC)
The Year-End Cliff (YEC) is an Axis Intelligence Research calculation of the website EBR™ on January 1, 2027, if the October 23, 2026 version mix does not change. YEC = 48.3% + 18.0% (PHP 8.2’s share of PHP websites) = 66.4%.
That would put about two in three PHP websites on an unsupported branch, and 46.0% of all websites with a known server-side language. The developer ecosystem shows the same cliff. After December 31, Axis Intelligence Research counts 181 of the top 1,000 Packagist packages with a minimum PHP that is still supported, down from 352, assuming no package raises its minimum.
Marcus Chen’s read: PHP2Shell gave PHP 8.2 owners a fix. The next critical bug after New Year’s Day will not. Anyone on 8.2 today is choosing between a planned upgrade in November or an emergency one in a year whose first PHP advisory they cannot patch. The YEC is not a forecast of what will happen. It is the size of the queue if nothing moves.
Who Uses PHP? Developer and Framework Statistics
PHP’s developer base is mature and concentrated on one framework. JetBrains’ State of PHP 2025, with 1,720 respondents who use PHP as their main language, found 89% using PHP 8.x, 33% using PHP 7.x and 8% using PHP 5.6 or older (respondents can use several versions).
| Metric | Value | As of | Source |
|---|---|---|---|
| PHP developers using Laravel | 64% | 2025 | JetBrains |
| PHP developers using WordPress | 25% | 2025 | JetBrains |
| PHP developers using Symfony | 23% | 2025 | JetBrains |
| PHP developers not planning to migrate to another language | 58% | 2025 | JetBrains |
| PHP developers regularly using AI assistants | 80% | 2025 | JetBrains |
| PHP developers using PHPStan | 36% | 2025 | JetBrains |
| PHP developers not writing tests | 32% | 2025 | JetBrains |
| All developers using PHP | 18.9% | 2025 | Stack Overflow |
| Professional developers using PHP | 19.1% | 2025 | Stack Overflow |
| Developers learning to code who use PHP | 14.5% | 2025 | Stack Overflow |
| PHP “admired” (current users who want to continue) | 38.9% | 2025 | Stack Overflow |
| PHP “desired” (all respondents who want to use it) | 9.2% | 2025 | Stack Overflow |
| Laravel usage, all respondents | 8.9% | 2025 | Stack Overflow |
| Composer usage, all respondents | 11.0% | 2025 | Stack Overflow |
| PHP rank, TIOBE Index | 12th (1.26%) | Oct 2026 | TIOBE |
How Big Is the PHP Package Ecosystem?
Packagist, the main repository for Composer, listed 475,283 packages and 5,966,378 versions on October 23, 2026, with 207,565,590,988 package installs recorded since April 13, 2012, according to Packagist’s statistics page.
Methodology
Collection. Axis Intelligence Research fetched every source on October 23, 2026 and logged each figure in the CSV with its URL, as-of date and retrieval date. Web usage and version data come from W3Techs pages dated October 22 and 23, 2026. Internet exposure data comes from Mallory’s corrected October 21 recount of Shodan counts, queried per exact patch version through X-Powered-By and Apache Server headers. Release, support and advisory data come from php.net. Timeline facts come from The PHP Foundation, Amazon Threat Intelligence, Cloudflare and the Canadian Centre for Cyber Security. Developer data come from Packagist (as analyzed by JetBrains developer advocate Brent Roose), JetBrains, Stack Overflow and TIOBE.
EBR™. End-of-Life Branch Reach is the share of a PHP population on branches the PHP project no longer supports (8.1 and older as of October 2026). Website EBR = PHP 7 share + PHP 5 share + PHP 4 share + PHP 8 share × (8.0 share + 8.1 share) ÷ 100 = 26.9 + 7.7 + 0.1 + 65.3 × 20.9 ÷ 100 = 48.35%. Service EBR = (57,002 + 797,060 + 857,707 + 213,338) ÷ 2,618,284 = 73.53%. Developer EBR = 5 + 1 + 5 = 11% (floor). Each lens uses only its own source; populations are never blended.
LGM. Legacy Gradient Multiple = service EBR ÷ website EBR = 73.53 ÷ 48.35 = 1.52.
YEC. Year-End Cliff = website EBR + PHP 8.2 share of PHP websites = 48.35 + 65.3 × 27.6 ÷ 100 = 66.37%. It holds the October 23, 2026 version mix fixed and is a scenario, not a forecast.
Verification. Every derived figure was computed twice in Python, once in floating point and once with exact rational arithmetic (fractions.Fraction); both passes agree to six decimal places. Every number in this article was matched to a CSV row.
Scope. W3Techs samples ranked websites and detects PHP only where it is visible, so sites that hide their version are excluded. Shodan counts are IP:port pairs; shared hosting places many websites behind one address, and distribution backports can leave a vulnerable-looking banner on a patched server. Composer installs over-represent developer and CI machines. These are reasons the three lenses are reported separately rather than averaged.
About This Dataset
php-statistics.csv contains 330 rows covering PHP’s web share, version distribution by major and minor version, PHP2Shell timeline and exposure counts by branch, country and hosting provider, Composer adoption by version, developer survey results, and every EBR™, LGM and YEC value with its formula in method_note. Each row carries source_org, source_document, source_url, retrieved_date, is_primary and axis_calculated.
- License: CC BY 4.0. Reuse freely with attribution to Axis Intelligence Research.
- Mirrors: Hugging Face, Kaggle and GitHub (Axis Intelligence Research).
How to Cite This Page
APA: Axis Intelligence Research, & Chen, M. (2026, October 23). PHP statistics 2026: Usage, version share and PHP2Shell exposure data. Axis Intelligence. https://axis-intelligence.com/php-statistics/
MLA: Axis Intelligence Research, and Marcus Chen. “PHP Statistics 2026: Usage, Version Share and PHP2Shell Exposure Data.” Axis Intelligence, 23 Oct. 2026, axis-intelligence.com/php-statistics/.
Chicago: Axis Intelligence Research and Marcus Chen. “PHP Statistics 2026: Usage, Version Share and PHP2Shell Exposure Data.” Axis Intelligence, October 23, 2026. https://axis-intelligence.com/php-statistics/.
PHP2Shell and PHP Version FAQ
Is it safe to keep running PHP 8.1 after PHP2Shell?
No packaged fix exists. PHP stopped releasing updates for 8.1 and older and published only source-level backports for 7.4, 8.0 and 8.1 on October 21, 2026. Unless your distribution or long-term-support vendor ships a backported package, an internet-facing PHP 8.1 server remains exposed to CVE-2026-109618 and CVE-2026-109619.
Which PHP versions fix CVE-2026-109618 and CVE-2026-109619?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, all released on October 21, 2026. Linux distributions and long-term-support vendors received the patches in advance, so their packages may fix the flaws without changing the version number. PHP 8.6.0 RC4, released the same day, contains the fixes but is not for production use.
Does updating WordPress or Laravel protect against PHP2Shell?
No. The flaws are in the PHP interpreter, not in application code, so updating WordPress, Laravel, Drupal or plugins changes nothing. The PHP binary itself must be updated, either directly or by the hosting provider. Our WordPress statistics cover the CMS layer separately.
What is the minimum safe PHP version to target in late 2026?
PHP 8.3 is supported for security fixes until December 31, 2027, PHP 8.4 until December 31, 2028, and PHP 8.5 until December 31, 2029. PHP 8.2 support ends December 31, 2026. For a migration started in late 2026, 8.4 or 8.5 avoids a second upgrade within a year.
How many websites still run PHP 7.4?
PHP 7.4 runs on 19.7% of PHP websites, Axis Intelligence Research calculates from W3Techs data dated October 23, 2026 (26.9% on PHP 7 × 73.4% of those on 7.4). Mallory counted about 411,000 internet-facing services on PHP 7.4 on October 21, 2026.
Why don’t Dependabot or composer audit flag PHP2Shell?
The advisories were published on the php-src GitHub repository, not in the global or Packagist advisory databases those tools read. Mallory’s October 21, 2026 test found no alert from Dependabot or composer audit, and Trivy could not distinguish vulnerable from fixed official PHP Docker images.
Is PHP2Shell on CISA’s Known Exploited Vulnerabilities list?
Not as of October 22, 2026, according to watchTowr, even though Amazon, Cloudflare and watchTowr reported exploitation attempts. CISA adds a CVE when it has evidence of exploitation; attempts against honeypots and WAFs are not the same as a confirmed compromise.
Is PHP losing ground to JavaScript on the server?
Slowly. W3Techs measured PHP at 69.3% of websites with a known server-side language in October 2026, while JavaScript became the second most used server-side language on July 27, 2026 at 8.1%. PHP still leads JavaScript by a factor of 8.6.
Why do different sources give such different numbers for outdated PHP?
They count different things. Composer data counts developer installs (at least 11% end-of-life), W3Techs counts ranked websites (48.3%), and Shodan counts every internet-facing service (73.5%). Axis Intelligence Research’s EBR™ reports all three side by side instead of averaging them.
Related on Axis Intelligence: Most popular programming languages 2026 · WordPress statistics 2026 · KEV tracker · Zero-day tracker · Data breach tracker · Web hosting statistics