When the PHP2Shell flaws were patched on October 21, 2026, headlines repeated one number: PHP runs 70% of the internet. The PHP websites percentage that W3Techs actually measured a day later is 69.3%, and it comes with a qualifier that changes its meaning. W3Techs counts only websites whose server-side programming language it can identify.
Where it stands: On 22 October 2026, W3Techs reported that “PHP is used by 69.3% of all the websites whose server-side programming language we know.” It also notes that a website may use more than one server-side language.
That distinction sounds pedantic until you see how far the figure drifted as it traveled. Within a day, the same statistic appeared as 69.3%, almost 70%, 70%, 70.8% and 75%, depending on who was writing.
What is the real PHP websites percentage?
The current measured figure is 69.3% of websites whose server-side language W3Techs can detect, as of 22 October 2026. W3Techs is a web technology survey run by Q-Success that classifies sites by the software it can observe on them.
Two caveats are built into that number. First, sites that hide their server-side language are not in the denominator at all, so 69.3% is not a share of every website. Second, W3Techs says one site can use more than one language, so the shares in its chart are not slices of a single pie.
The same W3Techs chart puts JavaScript second at 8.1% and Ruby third at 7.1%. W3Techs noted on 27 July 2026 that JavaScript had overtaken Ruby for second place.
Who said 70%, and who said 75%?
Several respected sources rounded or restated the figure in ways that do not match W3Techs’ live page. The gaps come from different dates, rounding or looser wording. The table below sets them side by side.
| Source (date) | What it said | How it compares |
|---|---|---|
| W3Techs (22 Oct 2026) | 69.3% of sites with a known server-side language | The measurement |
| Cloudflare (21 Oct) | “almost 70% of websites” | Rounded, qualifier dropped |
| Wiz (21 Oct) | 70% of all websites in the world | Rounded, qualifier dropped |
| watchTowr (21 Oct) | 70.8% “as of mid-2026” | Older reading, qualifier kept |
| ABC News (22 Oct) | about 75 per cent, citing W3Techs | Does not match W3Techs’ page |
Wiz went furthest. Its PHP2Shell post headline described the flaws as affecting 70% of the internet, which converts a usage share into an impact claim. Wiz is the research team that found some of the bugs, so it is a key source on the flaws themselves; the 70% framing, though, is a claim, not a survey result.
ABC’s “about 75 per cent,” attributed to W3Techs, does not match anything on W3Techs’ language page on 22 October. We could not find a W3Techs figure that supports it.
Does 69.3% mean that many sites were exposed to PHP2Shell?
No. A usage share tells you which language a site is built with. It does not tell you which PHP version the site runs, whether its host patched on October 21, or whether a firewall rule stood in front of it.
Newsweek, reporting on Wiz’s estimate, made the point directly: the share “does not mean 70 percent of websites are vulnerable to these particular attacks.” Reading a market-share figure as a victim count is the easiest way to misuse it.
For what to patch and how, see our PHP2Shell patch guide. For why version matters so much, see our piece on unsupported PHP versions.
How does WordPress fit into the PHP number?
WordPress is the most visible part of PHP’s reach. W3Techs reports that WordPress runs on 58.3% of sites whose content management system it can identify, and it equates that to 39.6% of all websites.
Note the different denominators. The WordPress figure of 39.6% is measured against all websites, while the PHP figure of 69.3% is measured only against sites with a detectable server-side language. The two numbers come from different surveys and should not be subtracted from or added to each other.
W3Techs describes WordPress as a content management system based on PHP. That is why the PHP2Shell runtime fix mattered to WordPress owners even though WordPress itself had no bug.
How many servers actually run PHP?
A different kind of count comes from VirusTotal, which scans the internet itself rather than classifying websites. Its October 21 count found roughly 5.1 million IP addresses running PHP; about 3.8 million had one or more ports open.
VirusTotal attached a warning to those numbers: they map where PHP is reachable from the internet, and they are not a list of hosts confirmed to be vulnerable. It also found that only around 1.1 million of those servers announce their PHP version in a header, meaning roughly four out of five hide it.
On the application side, VirusTotal counted about 538K IPs running WordPress, ahead of Laravel and Nextcloud. One IP address can host many websites, so these server counts and W3Techs’ website shares measure different things.
Why is PHP’s true footprint even harder to see?
Because PHP often hides inside other products. CISA’s October 21 alert warned that PHP is often a component of other software and that its prevalence “may not be directly observable.”
That cuts against the headline numbers in both directions. A survey of websites cannot see PHP running inside a router’s admin page or a vendor appliance, so it may miss real exposure. And a raw usage share cannot see which of those sites were already patched, so it overstates exposure.
For comparison, W3Techs measured Node.js, the JavaScript runtime that also shipped security fixes on October 21, at 7.4% of sites where its survey can identify the web server. That figure comes from a separate web-server survey and is not directly comparable to the language share.
Frequently Asked Questions
What percentage of websites use PHP?
69.3%, according to W3Techs on 22 October 2026, but only counting sites where W3Techs can detect the server-side language. That is a share of detectable sites, not of every website in existence.
Is PHP really 70% of the internet?
Not as a measured figure. Wiz and Cloudflare both rounded PHP to about 70% in their PHP2Shell posts, but the verifiable number is W3Techs at 69.3%, and only for sites whose server-side language W3Techs knows.
Does 69.3% mean 69.3% of websites were vulnerable to PHP2Shell?
No. Usage share says nothing about which PHP version a site runs, whether it was patched or whether a host put protections in front of it. Newsweek made the same point about the 70 percent figure.
What share of websites use WordPress?
W3Techs reported that WordPress is used by 39.6% of all websites, which is 58.3% of sites whose content management system it knows. WordPress is built on PHP.
How many servers run PHP?
VirusTotal counted roughly 5.1 million IP addresses running PHP on October 21, 2026. It stressed that this shows where PHP is exposed to the internet, not how many hosts are confirmed vulnerable.
Sources
- Usage Statistics and Market Share of Server-side Programming Languages for Websites, October 2026 — W3Techs (Q-Success), 22 October 2026
- Usage Statistics and Market Share of WordPress, October 2026 — W3Techs (Q-Success), 22 October 2026
- Usage Statistics and Market Share of Node.js, October 2026 — W3Techs (Q-Success), 22 October 2026
- PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet — Wiz Research, October 21, 2026
- Cloudflare deploys protections against php2shell vulnerability — Cloudflare Blog, October 21, 2026
- Australian government sites among those exposed to ‘critical’ PHP software flaw — ABC News (Australia), with Reuters, October 22, 2026
- PHP Remote Code Execution (“PHP2Shell” CVE-2026-109618 & CVE-2026-109619) — watchTowr Intel, October 21, 2026
- PHP Vulnerability: List of Websites Powered by PHP as Hacker Threat Prompts Scramble — Newsweek, October 21, 2026
- Sizing the PHP exposure window for CVE-2026-109618 and CVE-2026-109619 with VirusTotal — VirusTotal Blog, October 21, 2026
- Critical Vulnerabilities in PHP Require Immediate Patching — CISA, October 21, 2026
This article is news reporting and general security information based on the public sources listed above, as they stood on the dates shown. Incident details often change as investigations continue; check the affected company’s own status page and notices for the latest. Data Breach Radar is not affiliated with any company named here.