On October 21, 2026, PHP shipped emergency fixes for the PHP2Shell flaws, but only for its four supported branches: 8.2, 8.3, 8.4 and 8.5. Unsupported PHP versions, meaning 8.1 and everything older, got no official release. That matters because a large slice of the web is still running them.
Where it stands: As of 22 October 2026, W3Techs reports that PHP version 7, every branch of which is past end of life, runs on 18.7% of the sites where W3Techs can tell which server-side language is in use. CISA’s guidance for anyone still on 8.1 or below, or anyone who cannot patch yet: pull those PHP systems off the network for now.
The flaws themselves are covered in our PHP2Shell patch guide. This piece is about the long tail: the servers nobody upgraded, and what their owners can do now.
What counts as an unsupported PHP version?
Any PHP branch the PHP project no longer patches. For the PHP2Shell release, that line falls at 8.1: PHP’s advisory says “PHP 8.1 and older no longer receive updates from the PHP project.”
The patched builds start at 8.2.35 and run up through 8.3.36 and 8.4.27 to 8.5.12. If your server runs anything below 8.2, there is no official PHP download that fixes these bugs.
The supported list is about to shrink again. Automattic, the company behind WordPress.com, pointed out that the 8.2 branch loses support at the close of this year (its end-of-life date is December 31, 2026), so it steers customers to 8.3 or later.
How many websites run unsupported PHP versions?
A lot, though no source gives one tidy total, and we will not invent one by adding up percentages. Here is what W3Techs published on 22 October 2026, each figure in its own terms.
| PHP version | W3Techs share (22 Oct 2026) |
|---|---|
| Version 7 (all branches EOL) | 26.9% of sites using PHP |
| Version 5 (EOL) | 7.7% of sites using PHP |
| Version 8.1 (EOL) | 15.2% of PHP 8 sites |
| Version 8.0 (EOL) | 5.8% of PHP 8 sites |
| Version 8.2 (supported to Dec 31) | 27.7% of PHP 8 sites |
| Version 8.3 | 34.8% of PHP 8 sites |
Watch the denominators. The first two rows are shares of all PHP websites; the 8.x rows are shares of PHP 8 sites only. W3Techs separately puts PHP 7 at 18.7% of all sites with a known server-side language, and says 7.4 accounts for 73.4% of PHP 7 sites.
VirusTotal, which counts servers rather than websites, found a similar pattern among machines that reveal their version. About 758K IPs ran a retired branch somewhere from 5.4 up to 8.1, against about 272K on a supported branch. PHP 7.4 alone accounted for about 187K IPs. VirusTotal stresses these figures describe the internet-facing footprint, not confirmed vulnerable hosts.
Can old PHP versions get a PHP2Shell fix at all?
Sometimes, but not as an official PHP release. There are three routes, and which one applies depends on how your PHP was installed.
- Source backports from PHP. For the three most recent retired branches (8.1, 8.0 and 7.4), the PHP security team released small source-code patches, aimed at anyone who compiles PHP or has no long-term-support vendor.
- Vendor and distribution packages. PHP’s advisory says some distributions and LTS vendors provide backported fixes. According to GoDaddy, cPanel’s EasyApache 4 builds of 8.1, 8.0 and 7.4 now carry the fix.
- Nothing, for the oldest releases. For anything older than 7.4, Fastly says the PHP project is offering no patch, leaving it to whoever packages your PHP.
A backport is a stopgap. GoDaddy, even while pointing to cPanel’s patched packages, told customers to plan an upgrade to a supported version.
What does CISA tell organizations on old PHP?
Take the systems offline until they are fixed. In its October 21 alert, CISA’s line was that anyone unable to update right away, or anyone still on 8.1 or older, ought to disconnect PHP systems and keep them off the network until a fix or upgrade is in place.
That is unusually blunt advice from a government agency, and it reflects PHP’s own position: PHP’s release notes say “There are no complete mitigations, updating is the only safe choice.” Firewall rules from hosts and CDNs can reduce exposure, but none of them changes the version you are running.
How do I check my PHP version?
Check the version that actually serves your web pages, not just the one on the command line. On many servers those are different installations.
- WordPress sites: go to Tools, then Site Health, open the Info tab and expand the Server section. It lists the PHP version WordPress is running on.
- Hosting control panel: most hosts show the PHP version per site, often under a PHP selector or PHP settings page, and many let you switch branches there.
- Server shell:
php -vshows the command-line PHP. The web server may use a different PHP-FPM pool or module, so confirm through the panel or your server configuration too. - Do not leave diagnostic pages up. If you create a temporary page to print PHP details, delete it right after.
Hiding the version does not help. VirusTotal’s advice: turning expose_php off hides the header, not the vulnerability.
What should I do if I am stuck on PHP 7 or 8.1?
Treat it as an upgrade project with a deadline, and use a backport only to buy time. Automattic’s warning applies here: this is a runtime fix, so new WordPress, theme or plugin releases cannot close it.
- Managed hosting: ask your host which PHP version your site runs and whether that build includes the PHP2Shell fix. Get the answer in writing.
- Your own server: check whether your distribution or LTS vendor ships a backported package. If not, plan the move to 8.3 or newer.
- Test before switching: old plugins and custom code are a common reason sites stay on old PHP. Clone the site to a staging copy and try the newer branch there first.
- Appliances and vendor products: if PHP is bundled inside something you cannot update directly, ask the vendor for its PHP2Shell status.
For how big the PHP footprint really is, see our breakdown of the PHP websites percentage. Our sibling guide on patching PHP2Shell on WordPress hosting covers which hosts have already updated.
Frequently Asked Questions
Which PHP versions are still supported?
Four branches: 8.2, 8.3, 8.4 and 8.5, each with a PHP2Shell fix (8.2.35 is the oldest patched build). PHP 8.1 and older no longer get updates, and Automattic notes that 8.2 drops out of support on December 31, 2026.
Is there a PHP2Shell fix for PHP 7.4 or 8.1?
Not an official release. The PHP security team offered small source patches covering 8.1, 8.0 and 7.4 for people who compile PHP themselves, and some vendors, including cPanel according to GoDaddy, shipped patched packages. Fastly says versions under 7.4 get no patch from PHP.
How do I check which PHP version my website uses?
In WordPress, open Tools, then Site Health, then the Info tab and expand Server. Your hosting control panel usually shows it too. On a server, php -v shows the command-line version, which can differ from the version serving web pages.
What does CISA say about old PHP versions?
Its October 21 alert told anyone on 8.1 or older, and anyone who cannot patch right away, to unplug their PHP systems until a patch or upgrade lands.
How many websites still run PHP 7?
About 18.7% of sites with a detectable server-side language, according to W3Techs on 22 October 2026. Every PHP 7 branch is past end of life.
Sources
- Security advisory: Critical remote code execution vulnerabilities, update now — PHP.net (PHP security team), October 21, 2026
- Critical Vulnerabilities in PHP Require Immediate Patching — CISA, October 21, 2026
- Your Sites Are Protected Against the PHP2Shell Vulnerabilities — Automattic, October 21, 2026
- Usage Statistics and Market Share of PHP for Websites, October 2026 — W3Techs (Q-Success), 22 October 2026
- Usage Statistics and Market Share of PHP Version 8 for Websites, October 2026 — W3Techs (Q-Success), 22 October 2026
- Usage Statistics and Market Share of PHP Version 7 for Websites, October 2026 — W3Techs (Q-Success), 22 October 2026
- Sizing the PHP exposure window for CVE-2026-109618 and CVE-2026-109619 with VirusTotal — VirusTotal Blog, October 21, 2026
- Important PHP security update: What website owners need to do — GoDaddy Blog, October 21, 2026
- Fastly’s Proactive Protection for PHP2Shell, Critical PHP RCE CVE-2026-109618 and CVE-2026-109619 — Fastly Blog, October 21, 2026
This article is news reporting and general security information based on the public sources listed above, as they stood on the dates shown. Incident details often change as investigations continue; check the affected company’s own status page and notices for the latest. Data Breach Radar is not affiliated with any company named here.