Prosperity Atlas Germany
Interactive atlas for 44 countries: GDP, income tax, social contributions, tax burden, home ownership, wealth, pensions and prices from 1996 to 2025. Pick countries straight on the map.
Like: 0Share: 0
Explore
Security · Interactive
Two runtime flaws. One request. Code on the server.
In October 2026, two flaws in PHP's runtime let a single unauthenticated request run code on the server. We mapped the global exposure, scored what a breach would reach, and built an honest self-check.
What you can explore
One circle, one century, every country
01
A worldwide footprint
Hosts that disclose a PHP version sit in every region — the United States alone is 43% of the measured footprint.
02
Severity is not evenly spread
A breach of phpMyAdmin or a storefront reaches far more than a brochure site. We score each app family 4–12 on what it exposes.
03
Four days in the dark
Attacks began on 17 October — four days before a patch existed. Exposed, unpatched hosts from that window may already be compromised.
- CVSS v4.0 severity
- 9.2
- of websites run on PHP
- 69.3%
- of version-showing hosts unsupported
- 72–76%
- attacks ran before the fix
- 4 days
The AI use case
How we built it
We started from the public advisories and independent scans, cross-checked the claims, and kept only what held up.
Gather
Collected the PHP advisories and a dozen independent internet scans — Unit 42, Modat/Flare, Black Kite, VirusTotal, ELLIO, W3Techs.
Cross-check
Compared every headline claim against the others. Where units differed — instances vs hosts vs services — we refused to add them.
Score
Built a gravity score from confidentiality, integrity, availability and reach, so exposure reflects what a breach actually touches.
Build
Rendered the map, charts and self-check as one self-contained app — AI-assisted, human-reviewed, and it never scans anyone's site.
Sources and licences
PHP.net security advisories — fixed in 8.5.12, 8.4.27, 8.3.36, 8.2.35 (21 Oct 2026)
Amazon Threat Intelligence; Palo Alto Unit 42; ELLIO (exploitation timeline & sensors)
Modat via Flare; Black Kite; VirusTotal; Mallory (internet-wide scans)
W3Techs (PHP usage across the web)
Keep exploring
More experiments
Azure Local Radar
A daily radar for Microsoft Azure Local: priorities, fixed bugs, security updates, dependencies and roadmap in one place.
Like: 0Share: 0
Explore
Wind Fleet Insight
A fictional wind fleet across Germany with live DWD weather: power curves with alarm lines, vibration spectra, a 3D turbine that shows the faulty part, the chance of failure within 72 hours, real repair costs, spare parts, crews and road routes.
Like: 0Share: 0
Explore
Your Next Step
Want an analysis like this for your own estate? We help teams find, score and fix exposure before it becomes a headline.