PHP2Shell — interactive exposure explorer

Where the exposure sits

One scan's geographic footprint of hosts that disclose a PHP version — 12 measured locations, 2,126,813 IPs. Click a bubble or a bar to inspect a location; filter by region.

measured location country with a measured city bubble area ∝ exposed IPs

Top locations by exposed IPs

all regions

Shares are of these 12 measured locations only — not a global total. Wider scans count tens of millions more hosts that never reveal where they sit; see “What we verified”. Source: Modat/Flare geographic footprint, Oct 2026.

Four days before the fix

Attacks began on 17 October — four days before a patch existed. On 21 October, sensor hits climbed through the day and peaked after the CVE and a proof-of-concept leaked by mistake.

Key moments

discovery leak attack defence fix

Times in UTC. Sources are named per event. Sensor counts from ELLIO; first-exploitation date from Amazon Threat Intelligence (honeypots).

What runs on it, and what you run it on

Exposure is not evenly serious. “Gravity” scores each app family on what a breach would reach — confidentiality, integrity, availability and blast radius (4–12). Your server setup decides whether the flaw is even in your path.

Sort applications by:

Is the flaw even in your path?

Select your setup to see the evidence level and what to do.

Gravity = confidentiality + integrity + availability + reach, each 1–3 (so 4–12). Application host counts and server setups from the Oct 2026 scans; gravity is Insight42's scoring, human-reviewed.

Check your own exposure

Answer four questions about what you run. The readout is computed only from your answers — it never contacts, scans or touches your site.

This is a self-assessment from the facts you enter, mapped to the published severity, the branch support calendar and the exploitation evidence. It is guidance, not a scan or an audit, and not a guarantee that you are or are not affected.

What we checked, and what we changed

We started from the public reports, cross-checked the claims against each other, and kept the figure that held up. Where units differed, we refused to add them.

Six scans, six units — never one total

Each counts a different thing. Adding them would triple-count the same servers.

Claim vs. checked

Full source list on the report page below the explorer. Severity 9.2 under CVSS v4.0 (a leaked 10.0 and some trackers' 9.8 were set aside). Not found in CISA KEV as of 22 Oct 2026 in the sources reviewed.