PHP2Shell: 358 Japanese Companies Already Running Patched Versions, While 77.1% Remain on Unsupported PHP

On October 21, 2026, two critical PHP vulnerabilities known as "PHP2Shell" (CVE-2026-109618, CVE-2026-109619), which can lead to unauthenticated remote code execution, were disclosed. Fixed releases were published the same day.

In response, Pentacon Research brought forward the October 2026 observation of its monthly "Japan External Attack Surface" study. Observation began about seven hours after the fixed releases were published.

Observation results for 44,425 Japanese companies

We observed the websites of 44,425 Japanese companies. For the 2,941 companies whose PHP version could be read from the response headers, we tallied whether they were using the patched PHP releases.

Source: Pentacon Research, "Japan External Attack Surface," October 2026 observation

In this observation, made about seven to eight hours after the fixed releases were published, 358 companies were using the newly released fixed versions.

Among the 674 companies on the supported PHP 8.2–8.5 release series, 358 (53.1%) were using the fixed release.

77.1% of companies use versions no longer supported

Of the 2,941 companies whose PHP version could be confirmed, 2,267 (77.1%) were on release series no longer supported by the PHP project.

By series, 1,030 companies were on PHP 7.4, 267 on 5.6, and 139 on 5.3.

Unlike PHP 8.2–8.5, for which fixed releases addressing this vulnerability were published, these series are outside the PHP project's security support.

For the PHP 7.4–8.1 series, the PHP security team has published minimal fixes as source code. Distributions and long-term support vendors may also provide fixes while keeping the old version numbers. As a result, some of the companies using versions no longer supported may have the fixes applied.

Applying the fixed release and migrating from older versions

In this observation, more than half of the companies on supported PHP versions were already running the fixed release about seven to eight hours after it was published. At the same time, 77.1% of the companies covered were on versions no longer supported.

Even within PHP updates, applying a security fix to a supported series is different from migrating from an old series to a new one.

The latter may require compatibility checks or changes to existing web applications.

These results show that while rapid responses to a critical vulnerability are under way, migrating away from software that is no longer supported remains a challenge.

Survey data

Pentacon Research, "Japan External Attack Surface," October 2026 observation

Observed companies: 44,425 Japanese companies

PHP tally: 2,941 companies whose version could be confirmed