x.com/choblin29/status/2113163141538267148
1 correction found
And Censys found ~1.5 MILLION of 2.6 million identified PHP hosts running versions with NO PATCH available for those versions.
This overstates Censys’s numbers and misstates patch availability. Censys said about 1.15 million hosts were on unsupported branches with no official release, and it noted vendor backports and PHP source backports do exist for some older branches.
Full reasoning
Censys’s own advisory does not say that ~1.5 million of 2.6 million PHP hosts had “no patch available.” It says:
- Censys observed 2,580,515 PHP hosts.
- Of the hosts that reported a PHP version, about 1.15 million were on unsupported branches (PHP 8.1 or earlier) that get no official release.
- Censys immediately qualifies that by saying those hosts may still receive fixes via Linux distribution / LTS vendor backports or via PHP’s minimal source backports for 7.4, 8.0, and 8.1.
PHP’s own advisory matches that: while 8.1 and older do not get normal project updates, some distributions and LTS vendors provide backported fixes, and PHP also published minimal source backports for 7.4, 8.0, and 8.1.
So the post is inaccurate in two ways:
- It inflates the “no official release” population from about 1.15 million to ~1.5 million.
- It turns “no official release” into “NO PATCH available,” which is stronger than the source supports, because backported fixes and source backports were available for some of those older branches.
2 sources
- Oct 21 Advisory: PHP Unauthenticated Remote Code Execution [CVE-2026-109618, CVE-2026-109619] - Censys
Censys observes 2,580,515 hosts ... About 1.15 million report a branch the PHP project no longer supports, 8.1 or earlier, which gets no official release. Those hosts depend on a Linux distribution or long-term support vendor backport, or on PHP’s minimal source backports for 7.4, 8.0, and 8.1.
- PHP
PHP 8.1 and older no longer receive updates from the PHP project. Some distributions and LTS vendors provide backported fixes ... Given the severity of these vulnerabilities, the PHP security team provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1.