FOFA SECURITY INSIGHTS

PHP Security Spotlight

On October 21, 2026, PHP disclosed two critical vulnerabilities that can allow unauthenticated remote code execution in affected deployments.

CVE-2026-109618 OOM corruption ↗ CVE-2026-109619 Stale global state ↗

Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

FOFA queryapp="php"View in FOFA ↗
229,953,306Records (past year)
44,071,042Records (past year, reported versions)
4,021,437Records (past year, reported versions)
2026-11-15 01:00Updated hourly

Statistics use publicly visible PHP fingerprints. A missing version does not mean an asset is unaffected.

Download PHP assets

Filter by location and version, then choose your fields

Affected versions ↓ No reported version ↓ All PHP assets ↓

Patch overview

Release advisory ↗
8.362%
Patched share
Identifiable valid reported versions
4,021,437 / 48,092,479
Excludes missing, incomplete and invalid versions
8.2.35883,722
8.3.361,639,255
8.4.27777,513
8.5.12720,947

Global distribution

239 countries / regions
Not provided<1M1M–5M5M–10M10M–50M≥50M
Country / territoryAssets ↓
  1. United States of America99,811,058
  2. China31,953,274
  3. Germany11,620,088
  4. Hong Kong Special Administrative Region11,015,611
  5. Singapore8,356,913
  6. Japan5,711,467
  7. France5,682,973
  8. United Kingdom of Great Britain and Northern Ireland5,203,812
  9. Netherlands4,004,272
  10. Russian Federation3,167,527
  11. India2,970,545
  12. Canada2,835,060
  13. Korea (Republic of)2,809,124
  14. Brazil2,802,063
  15. Poland2,002,032
  16. Spain1,935,240
  17. Italy1,916,831
  18. Indonesia1,729,109
  19. Australia1,711,741
  20. Virgin Islands (British)1,629,617
  21. Taiwan, Province of China1,406,110
  22. Turkey1,295,794
  23. South Africa1,128,943
  24. Switzerland928,175
  25. Finland896,988
  26. Viet Nam828,105
  27. Sweden827,816
  28. Belgium798,387
  29. Czechia787,232
  30. Thailand742,643
  31. Malaysia719,933
  32. Iran (Islamic Republic of)717,316
  33. Denmark680,280
  34. Ireland617,634
  35. Ukraine493,476
  36. Mexico460,979
  37. Bulgaria443,807
  38. Argentina429,511
  39. Hungary418,821
  40. Lithuania412,982
  41. Romania408,360
  42. Austria356,348
  43. Bangladesh264,817
  44. Slovenia252,276
  45. Israel250,560
  46. Mauritius242,223
  47. Slovakia226,600
  48. Algeria226,455
  49. Portugal220,918
  50. Norway214,485
  51. Chile203,310
  52. Greece165,754
  53. Dominica147,776
  54. Morocco132,139
  55. United Arab Emirates130,558
  56. Serbia116,426
  57. Moldova (Republic of)108,391
  58. Croatia106,522
  59. Luxembourg106,058
  60. Colombia103,058
  61. Kazakhstan102,053
  62. New Zealand98,640
  63. Estonia86,823
  64. Belarus74,149
  65. Peru74,139
  66. Kenya73,501
  67. Bahrain66,865
  68. Latvia59,005
  69. Philippines57,749
  70. Pakistan55,803
  71. Uruguay52,615
  72. Saudi Arabia51,207
  73. Nigeria43,351
  74. Egypt39,364
  75. Cambodia39,270
  76. Nepal38,586
  77. Tunisia35,508
  78. Seychelles34,405
  79. Ecuador32,889
  80. Iceland28,371
  81. Bosnia and Herzegovina26,627
  82. Venezuela (Bolivarian Republic of)26,587
  83. Panama25,780
  84. Uzbekistan25,681
  85. Bolivia (Plurinational State of)25,472
  86. Libya20,573
  87. Lao People's Democratic Republic18,072
  88. Dominican Republic17,836
  89. Palestine, State of17,212
  90. Cyprus16,909
  91. Qatar16,652
  92. Mongolia16,292
  93. Macao Special Administration Region16,093
  94. Georgia15,367
  95. Ghana13,346
  96. Paraguay12,704
  97. Sri Lanka12,356
  98. Costa Rica11,523
  99. Kyrgyzstan10,211
  100. Iraq10,096
  101. Belize9,859
  102. North Macedonia9,847
  103. Senegal8,369
  104. Armenia8,301
  105. Tanzania, United Republic of8,066
  106. Honduras8,029
  107. Mozambique7,896
  108. Jordan7,801
  109. Albania7,013
  110. Guatemala7,001
  111. Azerbaijan7,000
  112. El Salvador6,642
  113. Syrian Arab Republic6,525
  114. Ethiopia5,886
  115. Afghanistan5,087
  116. Côte d'Ivoire5,055
  117. Puerto Rico4,363
  118. Uganda4,267
  119. Sierra Leone4,264
  120. Angola4,083
  121. Myanmar3,914
  122. Lebanon3,796
  123. Oman3,592
  124. Malta3,438
  125. Cuba3,309
  126. Zimbabwe3,189
  127. Rwanda3,140
  128. Benin2,971
  129. Namibia2,919
  130. Zambia2,818
  131. Tajikistan2,813
  132. Maldives2,709
  133. Montenegro2,567
  134. Kuwait2,224
  135. Réunion2,204
  136. Yemen2,117
  137. Cameroon1,950
  138. Burkina Faso1,946
  139. Malawi1,926
  140. Bhutan1,897
  141. Andorra1,778
  142. Madagascar1,757
  143. Isle of Man1,707
  144. French Polynesia1,647
  145. Saint Kitts and Nevis1,615
  146. Monaco1,611
  147. Jamaica1,595
  148. Liechtenstein1,567
  149. Turkmenistan1,526
  150. Nicaragua1,475
  151. Cayman Islands1,466
  152. Botswana1,465
  153. Lesotho1,373
  154. Haiti1,166
  155. New Caledonia1,052
  156. Brunei Darussalam1,012
  157. Congo (Democratic Republic of the)991
  158. Trinidad and Tobago974
  159. Suriname922
  160. Bahamas874
  161. Gibraltar843
  162. San Marino790
  163. Papua New Guinea725
  164. Eswatini711
  165. Curaçao695
  166. Timor-Leste690
  167. Aruba677
  168. Guyana655
  169. Mali652
  170. Togo649
  171. Gabon598
  172. Sudan585
  173. Mauritania564
  174. Niger554
  175. Martinique539
  176. Bonaire, Sint Eustatius and Saba530
  177. Cabo Verde500
  178. Liberia458
  179. Chad456
  180. Burundi452
  181. Fiji438
  182. Jersey437
  183. Guadeloupe411
  184. Anguilla404
  185. Faroe Islands390
  186. Bouvet Island377
  187. Samoa353
  188. Guam350
  189. Somalia288
  190. Solomon Islands274
  191. Barbados268
  192. Guinea260
  193. Gambia252
  194. Tonga239
  195. Guernsey213
  196. Djibouti212
  197. United States Minor Outlying Islands205
  198. Antigua and Barbuda195
  199. French Guiana191
  200. Virgin Islands (U.S.)179
  201. Palau168
  202. Comoros157
  203. Vanuatu150
  204. Korea (Democratic People's Republic of)148
  205. Åland Islands138
  206. Congo136
  207. Equatorial Guinea130
  208. Mayotte125
  209. Saint Lucia123
  210. Bermuda120
  211. French Southern Territories117
  212. Holy See111
  213. Saint Martin (French part)103
  214. Grenada73
  215. Micronesia (Federated States of)71
  216. South Sudan68
  217. Sint Maarten (Dutch part)66
  218. Saint Vincent and the Grenadines65
  219. Sao Tome and Principe64
  220. Wallis and Futuna58
  221. Greenland50
  222. Marshall Islands34
  223. Guinea-Bissau33
  224. Cook Islands28
  225. Kiribati28
  226. Nauru28
  227. Saint Pierre and Miquelon26
  228. Montserrat25
  229. American Samoa24
  230. Turks and Caicos Islands23
  231. Northern Mariana Islands19
  232. Tuvalu16
  233. Antarctica14
  234. Central African Republic13
  235. Eritrea11
  236. Saint Barthélemy10
  237. Falkland Islands (Malvinas)5
  238. Niue5
  239. Norfolk Island3

PHP version distribution

AffectedPatched

Major version distribution

Past year · Reported versions
8.x
57,633,54962.09%
7.x
26,043,71728.06%
5.x
8,947,2669.64%
4.x
198,0600.21%
Other
2,7610.00%

Minor version distribution

Top 10 by count · Click to view details
Affected
PHP versionRecordsShare of all PHP recordsVersion statusAction
8.5.323,088,74210.04%AffectedView in FOFA ↗
8.3.332,837,4851.23%AffectedView in FOFA ↗
8.2.331,945,5970.85%AffectedView in FOFA ↗
8.3.301,848,9030.80%AffectedView in FOFA ↗
8.2.301,735,8970.75%AffectedView in FOFA ↗
8.3.311,355,6670.59%AffectedView in FOFA ↗
8.3.351,152,3800.50%AffectedView in FOFA ↗
8.2.31834,3720.36%AffectedView in FOFA ↗
8.2.34706,6240.31%AffectedView in FOFA ↗
8.2.32554,0230.24%AffectedView in FOFA ↗
110 versions · 44,071,042 records
1 / 11

Based on publicly reported versions. Assets with no reported version and older versions still need investigation; applicability depends on deployment and vendor patches.

Check my assets

Match PHP and reported versions in bulk, then download marked results.

  1. 1Upload assets
  2. 2Identify assets
  3. 3Results ready

Upload assets to identify PHP and reported versions

Upload to start identification, then view statistics and download the results.

What is a reported PHP version?

A PHP version number identified by FOFA from publicly visible information. Without it, version impact cannot be determined.

Uses your account's quota.
Click or drop a file to startCSV / TXT · One host per rowUp to 1,000 entries · Max 1 MB

PHP ecosystem

Explore software and products built with PHP

Continuously updated
21 products
Twitter[email protected]
Feedback