# PHP Version Statistics After PHP2Shell: 100,000+ Sites

Frozen snapshot: **2026-10-25T05:35:55.887001+00:00**, or **25 October 2026, 07:35:55 EET**. This file contains shareable aggregate findings for the article and charts.

**100,893 distinct sites; 17,228 usable version reports; 5,329 (30.93%) past upstream end of life.** These are the self-selected sites submitted to Web Aloha’s PHP Version Checker.

## Key findings

- About 31% of eligible version reports named PHP 8.1 or older: 5,329 / 17,228.
- The shares advertising at least the October 21 fixed release were 32%, 52%, 60% and 70% in the October 21–24 first-eligible-observation cohorts. These are different sites each day.
- Of 6,146 reports below those thresholds, 4,811 (78.28%) named the immediately preceding release.
- Among 49,637 completed checks with PHP-related signals, 32,218 (64.91%) returned no version. This includes 25,626 WordPress-related signals.
- PHP 8.2 supplied 2,605 reports (15.12%), and remains security-supported through 31 December 2026.

## Version distribution

| Reported branch | Sites | Share of 17,228 |
| --- | ---: | ---: |
| 8.5 | 2,179 | 12.65% |
| 8.4 | 2,457 | 14.26% |
| 8.3 | 4,652 | 27.00% |
| 8.2 | 2,605 | 15.12% |
| 8.1 | 1,217 | 7.06% |
| 8.0 | 487 | 2.83% |
| 7.4 | 2,038 | 11.83% |
| 7.3 and older | 1,587 | 9.21% |
| 8.6 (unclassified) | 6 | 0.03% |

Six PHP 8.6 claims remain unclassified because the branch was still a release candidate. The percentage denominator includes those six claims.

| Lifecycle category | Sites | Share of eligible versions |
| --- | ---: | ---: |
| End of life: 8.1 and older | 5,329 | 30.93% |
| Security-only: 8.2–8.3 | 7,257 | 42.12% |
| Active: 8.4–8.5 | 4,636 | 26.91% |
| Unclassified: 8.6 | 6 | 0.03% |

## Final ordinary release clusters

| Reported release | Reports | Branch reports | Share of branch |
| --- | ---: | ---: | ---: |
| 7.4.33 | 1,740 | 2,038 | 85.38% |
| 8.0.30 | 408 | 487 | 83.78% |
| 8.1.34 | 1,025 | 1,217 | 84.22% |
| 5.6.40 | 330 | 411 | 80.29% |

Eight public reports named PHP 4.4.9, the final 4.4 release from 2008. These are observed strings, not verified installations. Single observations do not reveal an update history or vendor-maintenance status.

## Numeric release comparison

Thresholds for the October 21 PHP2Shell fixes: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Only complete, eligible three-component numeric versions on supported branches enter this metric; branch-only strings are excluded.

| First eligible UTC day | Full-version reports | At or above threshold | Share | Below threshold | Immediately previous release |
| --- | ---: | ---: | ---: | ---: | ---: |
| 2026-10-21 | 4,116 | 1,322 | 32.12% | 2,794 | 1,968 |
| 2026-10-22 | 5,322 | 2,768 | 52.01% | 2,554 | 2,158 |
| 2026-10-23 | 1,726 | 1,037 | 60.08% | 689 | 592 |
| 2026-10-24 | 369 | 260 | 70.46% | 109 | 93 |

Complete comparison-period total: 5,387 of 11,533 (46.71%) at or above the numeric thresholds. Below threshold: 6,146; immediately previous release: 4,811 (78.28%).

The date is the first eligible version-observation day, not necessarily the first attempted scan. Each day contains different sites. The release-day bucket includes pre- and post-announcement observations. The partial 25 October cohort is excluded. The figures do not measure same-site patch adoption, vendor backports, configuration or confirmed vulnerability.

## What the checker could see

| Completed PHP-related result | Sites | Share of 49,637 |
| --- | ---: | ---: |
| WordPress-related signal, no version | 25,626 | 51.63% |
| Other PHP-related signal, no version | 6,592 | 13.28% |
| Version signal | 17,419 | 35.09% |

The version-signal category includes 5 body-only signals and other evidence that does not meet the strong, unambiguous version-distribution rules. Only 17,228 reports pass every eligibility condition. PHP-related clues do not establish the executing runtime or that a site deliberately hides its version.

| All recorded primary results | Sites | Share of 100,893 |
| --- | ---: | ---: |
| Eligible public version | 17,228 | 17.08% |
| Completed, no eligible version | 72,119 | 71.48% |
| Incomplete or unavailable | 11,546 | 11.44% |

| Incomplete outcome | Sites | Share of all recorded sites |
| --- | ---: | ---: |
| Blocked/unavailable | 5,532 | 5.48% |
| Timed out | 2,626 | 2.60% |
| HTTP error | 1,494 | 1.48% |
| Partial | 1,028 | 1.02% |
| Not found | 570 | 0.56% |
| TLS error | 296 | 0.29% |

Some generic no-response cases map to blocked; this is not proof of intentional blocking. No collector-scope failures occur in this snapshot.

## Traffic

Across the four complete UTC days 21–24 October, GA4 recorded **108,474 run events**, **105,626 result events**, **52,665 measured users**, **67,051 sessions** and **71,605 pageviews**. Users/sessions were queried for the whole period, not summed from daily rows.

| UTC day | Run events | Result events | Pageviews | Daily users |
| --- | ---: | ---: | ---: | ---: |
| 2026-10-18 | 12 | 11 | 14 | 13 |
| 2026-10-19 | 54 | 50 | 70 | 63 |
| 2026-10-20 | 112 | 108 | 99 | 85 |
| 2026-10-21 | 37,955 | 37,066 | 23,766 | 18,043 |
| 2026-10-22 | 50,574 | 49,239 | 33,458 | 26,091 |
| 2026-10-23 | 17,011 | 16,494 | 11,831 | 9,795 |
| 2026-10-24 | 2,934 | 2,827 | 2,550 | 2,027 |

Traffic retrieval: 2026-10-25T05:36:39.237Z. Today’s partial 25 October traffic is excluded. Browser events, users and deduplicated research sites have different coverage. A run can fail or repeat a previous submission; a result need not contain a PHP version.

## Method and privacy

Research collection began 18 October. This statement snapshot covers first records through 25 October at the stated time; its first and final days are partial. The published cohort uses detector 2026-10-18.2, source php-version-checker, full mode. Three legacy-detector records stay separate. A single read-only database aggregate returned no invalid or out-of-window exclusions and no duplicates within the cohort.

One record is retained per registrable site, tool, source, mode and detector in a UTC month. Supported shared-hosting tenants remain separate. An ineligible record can be replaced by the first later eligible result; 729 records received that replacement. Later eligible observations do not continuously refresh the same record.

Version percentages require successful complete responses with strong, unambiguous public version evidence. In this detector, strong evidence is a PHP token in X-Powered-By. Headers can be stale or supplied by an intermediary. The signal chart and version distribution have deliberately different denominators.

Underlying research records contain pseudonymous coded site/page keys and limited technical results, without raw target URLs, page content, visitor IP addresses or analytics IDs. Separate IP-derived daily buckets cap research admission at 20 distinct sites when trusted IP data is available; that is not a per-person cap or proof of a bot-free sample. Research records are excluded after 90 days and purged through scheduled cleanup; aggregates may be retained longer. The public files contain aggregate counts only.

See the [research privacy notice](https://webaloha.co/privacy-policy/#website-tool-research). Self-selection, header disclosure, fresh-only collection, cache and input exclusions, admission controls and service availability limit inference. These data do not estimate global PHP prevalence, ownership, compromise, patch state or upgrade speed.

## Sources and reuse

- [PHP support schedule](https://www.php.net/supported-versions.php) and [unsupported branches/final releases](https://www.php.net/eol.php).
- [October 21 PHP security announcement](https://www.php.net/archive/2026.php#2026-10-21-5) and [October 23 session-upload-progress notice](https://www.php.net/archive/2026.php). The latter is a separate issue; meeting the October 21 version threshold does not resolve every later advisory.
- [Wiz’s PHP2Shell research](https://www.wiz.io/blog/php2shell-php-rce).
- [Mallory’s analysis](https://mallory.ai/blog/php-rce-rapid-response) corrected 59% to 73.5% for its different internet-service population and publishes its own version-report time series. This is context, not a validation of our sampling or an assertion of novelty.
- [Elementor requirements](https://elementor.com/help/requirements/) link to [our Elementor/PHP guide](https://webaloha.co/elementor-and-php-compatibility/) in the PHP recommendation; this is a documentation citation, not an endorsement of the study.

Charts include their source URL, sample and date. PNG downloads contain landscape and portrait exports. Licensing and press-contact questions can be sent to [Web Aloha](https://webaloha.co/contact/); no new reuse licence is granted by this file. The separately dated Google screenshot is excluded from the chart package.

Attribution: Web Aloha PHP Version Checker study, frozen 25 October 2026. Keep the sample, denominator and date with quoted figures. Percentages are independently rounded.