FOFA SECURITY INSIGHTS

PHP Security Spotlight

On October 21, 2026, PHP disclosed two critical vulnerabilities that can allow unauthenticated remote code execution in affected deployments.

CVE-2026-109618 OOM corruption ↗ CVE-2026-109619 Stale global state ↗

Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

FOFA queryapp="php"View in FOFA ↗
228,852,935Records (past year)
46,620,131Records (past year, reported versions)
374,860Records (past year, reported versions)
2026-10-24 20:00Updated hourly

Statistics use publicly visible PHP fingerprints. A missing version does not mean an asset is unaffected.

Download PHP assets

Filter by location and version, then choose your fields

Affected versions ↓ No reported version ↓ All PHP assets ↓

Patch overview

Release advisory ↗
0.798%
Patched share
Identifiable valid reported versions
374,860 / 46,994,991
Excludes missing, incomplete and invalid versions
8.2.3582,509
8.3.36146,182
8.4.2776,373
8.5.1269,796

Global distribution

239 countries / regions
Not provided<1M1M–5M5M–10M10M–50M≥50M
Country / territoryAssets ↓
  1. United States of America99,711,308
  2. China31,790,966
  3. Germany11,720,352
  4. Hong Kong Special Administrative Region10,596,302
  5. Singapore7,857,470
  6. Japan5,840,211
  7. France5,748,827
  8. United Kingdom of Great Britain and Northern Ireland4,238,750
  9. Netherlands3,964,748
  10. Russian Federation3,299,961
  11. Canada2,882,221
  12. Brazil2,840,021
  13. Korea (Republic of)2,835,607
  14. India2,676,284
  15. Poland2,026,854
  16. Italy1,977,173
  17. Spain1,962,424
  18. Indonesia1,796,412
  19. Australia1,722,218
  20. Virgin Islands (British)1,576,933
  21. Taiwan, Province of China1,412,688
  22. Turkey1,318,205
  23. South Africa1,134,928
  24. Switzerland955,348
  25. Finland901,337
  26. Sweden864,710
  27. Belgium857,851
  28. Viet Nam854,876
  29. Czechia824,352
  30. Thailand764,711
  31. Iran (Islamic Republic of)763,945
  32. Denmark736,023
  33. Malaysia719,741
  34. Ireland614,544
  35. Ukraine539,714
  36. Mexico465,804
  37. Lithuania453,964
  38. Bulgaria450,744
  39. Argentina447,556
  40. Hungary446,260
  41. Romania440,869
  42. Austria379,027
  43. Bangladesh264,986
  44. Slovenia247,602
  45. Mauritius244,106
  46. Slovakia231,192
  47. Portugal229,186
  48. Norway226,704
  49. Israel225,642
  50. Algeria219,612
  51. Chile215,125
  52. Greece173,334
  53. Dominica152,553
  54. United Arab Emirates148,100
  55. Morocco135,361
  56. Serbia116,988
  57. Croatia108,140
  58. Luxembourg106,777
  59. Moldova (Republic of)105,466
  60. Kazakhstan105,419
  61. Colombia104,766
  62. New Zealand98,375
  63. Estonia91,696
  64. Kenya78,904
  65. Belarus77,861
  66. Peru75,448
  67. Bahrain75,332
  68. Latvia63,179
  69. Philippines61,972
  70. Pakistan55,907
  71. Saudi Arabia53,612
  72. Uruguay52,355
  73. Nigeria46,773
  74. Egypt42,031
  75. Cambodia40,620
  76. Tunisia39,937
  77. Nepal38,643
  78. Seychelles36,794
  79. Ecuador34,450
  80. Bolivia (Plurinational State of)29,361
  81. Iceland29,127
  82. Panama28,530
  83. Bosnia and Herzegovina27,698
  84. Venezuela (Bolivarian Republic of)26,604
  85. Uzbekistan25,847
  86. Libya21,813
  87. Lao People's Democratic Republic19,542
  88. Palestine, State of19,117
  89. Qatar18,414
  90. Dominican Republic18,404
  91. Macao Special Administration Region17,094
  92. Ghana16,980
  93. Cyprus16,739
  94. Mongolia16,711
  95. Georgia16,024
  96. Costa Rica12,798
  97. Paraguay12,650
  98. Sri Lanka12,389
  99. Belize11,771
  100. Kyrgyzstan10,374
  101. Iraq10,101
  102. Senegal9,988
  103. North Macedonia9,730
  104. Jordan9,601
  105. Armenia9,404
  106. Mozambique8,898
  107. Tanzania, United Republic of8,177
  108. Honduras7,670
  109. Guatemala7,285
  110. El Salvador7,241
  111. Azerbaijan7,181
  112. Albania7,009
  113. Syrian Arab Republic6,341
  114. Ethiopia5,845
  115. Côte d'Ivoire5,382
  116. Afghanistan4,947
  117. Angola4,727
  118. Uganda4,667
  119. Puerto Rico4,464
  120. Sierra Leone4,265
  121. Zimbabwe4,095
  122. Myanmar3,955
  123. Oman3,911
  124. Lebanon3,825
  125. Zambia3,744
  126. Lesotho3,698
  127. Malta3,286
  128. Cuba3,240
  129. Rwanda3,155
  130. Benin2,974
  131. Namibia2,959
  132. Tajikistan2,846
  133. Maldives2,722
  134. Montenegro2,550
  135. Kuwait2,462
  136. Réunion2,354
  137. Yemen2,074
  138. Malawi1,965
  139. Burkina Faso1,959
  140. Cameroon1,954
  141. Bhutan1,864
  142. Andorra1,786
  143. Madagascar1,764
  144. New Caledonia1,705
  145. Liechtenstein1,659
  146. Saint Kitts and Nevis1,619
  147. French Polynesia1,618
  148. Monaco1,611
  149. Jamaica1,579
  150. Turkmenistan1,569
  151. Botswana1,502
  152. Cayman Islands1,475
  153. Nicaragua1,452
  154. Haiti1,291
  155. Eswatini1,218
  156. Trinidad and Tobago1,001
  157. Congo (Democratic Republic of the)988
  158. Suriname964
  159. Gibraltar929
  160. Bahamas869
  161. Brunei Darussalam851
  162. San Marino830
  163. Papua New Guinea729
  164. Curaçao703
  165. Timor-Leste691
  166. Aruba689
  167. Mali657
  168. Guyana655
  169. Togo648
  170. Isle of Man593
  171. Gabon569
  172. Mauritania568
  173. Bouvet Island567
  174. Niger551
  175. Sudan551
  176. Bonaire, Sint Eustatius and Saba526
  177. Martinique524
  178. Cabo Verde497
  179. Burundi458
  180. Chad456
  181. Liberia450
  182. Fiji440
  183. Jersey429
  184. Guadeloupe419
  185. Anguilla403
  186. Faroe Islands396
  187. Samoa363
  188. Djibouti362
  189. Guam356
  190. Somalia300
  191. Solomon Islands276
  192. Barbados268
  193. French Southern Territories268
  194. Gambia256
  195. Guinea253
  196. Tonga240
  197. Guernsey218
  198. French Guiana196
  199. Antigua and Barbuda190
  200. Palau168
  201. Virgin Islands (U.S.)166
  202. Vanuatu155
  203. Comoros147
  204. Åland Islands145
  205. Congo143
  206. Equatorial Guinea130
  207. Mayotte129
  208. Korea (Democratic People's Republic of)126
  209. Saint Lucia126
  210. United States Minor Outlying Islands123
  211. Bermuda120
  212. Holy See116
  213. Saint Martin (French part)106
  214. Micronesia (Federated States of)95
  215. Saint Vincent and the Grenadines83
  216. Sint Maarten (Dutch part)77
  217. Grenada73
  218. South Sudan71
  219. Sao Tome and Principe63
  220. Wallis and Futuna61
  221. Greenland60
  222. Guinea-Bissau34
  223. Nauru30
  224. Cook Islands28
  225. Saint Pierre and Miquelon25
  226. American Samoa24
  227. Montserrat24
  228. Turks and Caicos Islands24
  229. Kiribati23
  230. Marshall Islands21
  231. Northern Mariana Islands21
  232. Tuvalu16
  233. Antarctica12
  234. Central African Republic12
  235. Eritrea10
  236. Saint Barthélemy9
  237. Falkland Islands (Malvinas)5
  238. Niue5
  239. Norfolk Island3

PHP version distribution

Reported versions: PHP version numbers identified from publicly visible information.

AffectedPatched

Major version distribution

Past year · Reported versions
8.x
56,869,42261.32%
7.x
26,566,07328.64%
5.x
9,101,7349.81%
4.x
202,6850.22%
Other
2,8170.00%

Minor version distribution

Top 10 by count · Click to view details
Affected
PHP versionRecordsShare of all PHP recordsVersion statusAction
8.5.323,125,55210.10%AffectedView in FOFA ↗
8.3.333,010,4321.32%AffectedView in FOFA ↗
8.2.332,065,2310.90%AffectedView in FOFA ↗
8.3.301,941,4240.85%AffectedView in FOFA ↗
8.2.301,800,7580.79%AffectedView in FOFA ↗
8.3.311,463,5920.64%AffectedView in FOFA ↗
8.3.351,330,7580.58%AffectedView in FOFA ↗
8.2.31892,6110.39%AffectedView in FOFA ↗
8.2.34788,9010.34%AffectedView in FOFA ↗
8.2.29715,4290.31%AffectedView in FOFA ↗
109 versions · 46,620,131 records
1 / 11

Based on publicly reported versions. Assets with no reported version and older versions still need investigation; applicability depends on deployment and vendor patches.

Check my assets

Match PHP and reported versions in bulk, then download marked results.

  1. 1Upload assets
  2. 2Identify assets
  3. 3Results ready

Upload assets to identify PHP and reported versions

Upload to start identification, then view statistics and download the results.

What is a reported PHP version?

A PHP version number identified by FOFA from publicly visible information. Without it, version impact cannot be determined.

Uses your account's quota.
Click or drop a file to startCSV / TXT · One host per rowUp to 1,000 entries · Max 1 MB

PHP ecosystem

Explore software and products built with PHP

Continuously updated
9 products
Twitter[email protected]
Feedback