Security · Interactive
In October 2026, two flaws in PHP's runtime let a single unauthenticated request run code on the server. We mapped the global exposure, scored what a breach would reach, and built an honest self-check.
What you can explore
Hosts that disclose a PHP version sit in every region — the United States alone is 43% of the measured footprint.
A breach of phpMyAdmin or a storefront reaches far more than a brochure site. We score each app family 4–12 on what it exposes.
Attacks began on 17 October — four days before a patch existed. Exposed, unpatched hosts from that window may already be compromised.
The AI use case
We started from the public advisories and independent scans, cross-checked the claims, and kept only what held up.
Collected the PHP advisories and a dozen independent internet scans — Unit 42, Modat/Flare, Black Kite, VirusTotal, ELLIO, W3Techs.
Compared every headline claim against the others. Where units differed — instances vs hosts vs services — we refused to add them.
Built a gravity score from confidentiality, integrity, availability and reach, so exposure reflects what a breach actually touches.
Rendered the map, charts and self-check as one self-contained app — AI-assisted, human-reviewed, and it never scans anyone's site.
PHP.net security advisories — fixed in 8.5.12, 8.4.27, 8.3.36, 8.2.35 (21 Oct 2026)
Amazon Threat Intelligence; Palo Alto Unit 42; ELLIO (exploitation timeline & sensors)
Modat via Flare; Black Kite; VirusTotal; Mallory (internet-wide scans)
W3Techs (PHP usage across the web)
Keep exploring
A fictional wind fleet across Germany with live DWD weather: power curves with alarm lines, vibration spectra, a 3D turbine that shows the faulty part, the chance of failure within 72 hours, real repair costs, spare parts, crews and road routes.
Polar ice, Greenland, Indian Ocean islands, coral reefs, wildfires and 139 major disasters on one globe, 1900–2026. Every figure is linked to its source.
A fictional production run for the X-15, SR-71A, XB-70A, Concorde and Junkers F 13: lines and gates, parts in 3D, warehouses, transport on a world map and a globe. Every record says what it is, where it is, why it waits and what to do next.
Want an analysis like this for your own estate? We help teams find, score and fix exposure before it becomes a headline.