x.com/fiveoutofnine/status/2113045722744717360?s=20
1 correction found
Censys says like 1.5 million servers are running a version with no fix
Censys did not say 1.5 million hosts were on unfixed PHP branches. Its own Oct. 21 advisory says about 1.15 million hosts reported unsupported PHP 8.1-or-earlier branches with no official release.
Full reasoning
This overstates what Censys reported.
In Censys's own October 21, 2026 advisory on the PHP vulnerabilities, the company says "About 1.15 million" hosts report a PHP branch the project no longer supports, specifically 8.1 or earlier, which means no official release from PHP for those branches. That is the relevant Censys figure for systems with no official fix.
So the post's attribution to Censys of "1.5 million servers ... with no fix" is inaccurate. The 1.5 million number has circulated in some secondary coverage, but Censys's own advisory gives the no-official-fix count as ~1.15 million, not 1.5 million.
1 source
- Oct 21 Advisory: PHP Unauthenticated Remote Code Execution [CVE-2026-109618, CVE-2026-109619] - Censys
On October 21, 2026... Censys Queries Platform... Found: 6,292,667 hosts... About 1.15 million report a branch the PHP project no longer supports, 8.1 or earlier, which gets no official release.