PHP2Shell leaves servers on PHP versions with no official fix
Comments on “PHP2Shell leaves servers on PHP versions with no official fix”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Official fixes for the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) cover PHP 8.2 to 8.5, while older branches got only minimal source backports for 7.4, 8.0 and 8.1, and nothing for 5.6 or 7.3 and earlier. A Shodan count put about 884,000 hosts, 59% of those exposing a version, on unsupported releases. These are banner counts, not confirmed vulnerable sites, and distributions may patch under old version strings. Check vendor changelogs for both CVE IDs, and plan a move to 8.4 or 8.5.
Why it ranked
No. 9 of 62 with a score of 0.70. The panel rated it highest on reader interest (0.81) and practical relevance (0.79), lowest on technical depth (0.60). The judges disagreed most on new information (spread 0.47), so the story is marked contested.
Every answer behind this is in the table under Score.
Score
0.70total under rubric v2.2Contestedjudges differ by 0.47 on new information
- Significance0.68
- Reader interest0.81
- Audience breadth0.67
- Practical relevance0.79
- Substantiated0.66
- Technical depth0.60
- New information0.65
- Counts against: Promotional0.04
- Counts against: Overclaim0.26
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| Significance | 0.73 | 0.60 | 0.72 | 0.68 | 0.13 | +0.24 | +0.164 |
| Reader interest | 0.74 | 0.80 | 0.90 | 0.81 | 0.16 | +0.26 | +0.211 |
| Audience breadth | 0.62 | 0.67 | 0.72 | 0.67 | 0.10 | +0.13 | +0.087 |
| Practical relevance | 0.67 | 0.85 | 0.86 | 0.79 | 0.20 | +0.22 | +0.174 |
| Substantiated | 0.61 | 0.60 | 0.78 | 0.66 | 0.18 | +0.05 | +0.033 |
| Technical depth | 0.68 | 0.60 | 0.52 | 0.60 | 0.15 | +0.05 | +0.030 |
| New information | 0.87 | 0.40 | 0.68 | 0.65 | 0.47 , above the contested threshold | +0.05 | +0.033 |
| Promotional | 0.06 | 0.05 | 0.02 | 0.04 | 0.04 | −0.19 | −0.008 |
| Overclaim | 0.33 | 0.25 | 0.20 | 0.26 | 0.13 | −0.11 | −0.029 |
| Sum of contributions | +0.695 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.696 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-26/9/"><img src="https://rubric.hrih.si/badge/2026-10-26/9.svg" alt="Ranked #9 on Rubric, 26 Oct 2026" width="238" height="28"></a>Claim check
Claim check: 4 matches source · 4 no source given. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
No source givenVersion
The PHP2Shell fixes cover only PHP 8.2 to 8.5.
The article gives no link or citation for it.
The article says “The PHP2Shell fixes cover only PHP 8.2 to 8.5”
The source says No source to compare with.
Matches sourceNumber
A Shodan count published by Mallory on October 20 found about 884,000 internet-facing hosts advertising an unsupported PHP version, 59% of the roughly 1.5 million hosts that reveal one.
The cited source says the same thing.
The article says “found about 884,000 internet-facing hosts advertising an unsupported PHP version, or 59% of the roughly 1.5 million hosts that reveal one”
The source says “59% of those that report a version (883,717 of about 1.5 million) run a branch with no official release. These figures come from Shodan banner counts published by Mallory on…”
Source cited by the article: cybelangel.com/blog/critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619
Matches sourceNumber
CybelAngel's breakdown puts PHP 5.x at around 369,000 hosts, PHP 7.x at 329,000, and PHP 8.0 and 8.1 at 186,000, against 612,000 on 8.2 to 8.5.
The cited source says the same thing.
The article says “PHP 5.x at around 369,000 hosts, PHP 7.x at 329,000, and PHP 8.0 and 8.1 at 186,000, against 612,000 on 8.2 to 8.5”
The source says “PHP 8.2 to 8.5 account for 612,269 versioned hosts and are covered by the official release. PHP 5.x (368,570), 7.x (329,358) and 8.0–8.1 (185,789) are not”
Source cited by the article: cybelangel.com/blog/critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619
No source givenNumber
Palo Alto Networks counted more than 22.6 million potentially vulnerable instances.
The article gives no link or citation for it.
The article says “Palo Alto Networks separately counted more than 22.6 million potentially vulnerable instances”
The source says No source to compare with.
Matches sourceVersion
PHP published minimal source backports for 7.4, 8.0, and 8.1, but nothing for 5.6 or 7.3 and older, and released no numbered versions for end-of-life branches.
The cited source says the same thing.
The article says “It did publish minimal source backports for 7.4, 8.0, and 8.1, aimed at people who compile PHP themselves”
The source says “No numbered releases. The security team published minimal source backport branches in php-src for those three, for people who build from source or have no LTS vendor. There is nothing…”
Source cited by the article: safeguard.sh/resources/blog/php2shell-end-of-life-php-7-4-8-0-8-1-options
Matches sourceDate
PHP 8.1 reached end of life on December 31, 2025; 8.0 in November 2023; and 7.4 in November 2022.
The cited source says the same thing.
The article says “PHP 8.1 reached end of life on December 31, 2025; 8.0 in November 2023; and 7.4 in November 2022”
The source says “PHP 8.1 since December 31, 2025, PHP 8.0 since November 26, 2023, PHP 7.4 since November 28, 2022, and PHP 5.6 since December 31, 2018”
Source cited by the article: greenbone.net/en/blog/php2shell-remote-code-execution-cve-2026-109618-cve-2026-109619
No source givenVersion
Ubuntu 22.04 patches its PHP 8.1 package through the normal security channel, while 7.4 on Ubuntu 20.04 needs Ubuntu Pro.
The article gives no link or citation for it.
The article says “Ubuntu 22.04 patches its PHP 8.1 package through the normal security channel, while 7.4 on Ubuntu 20.04 needs Ubuntu Pro”
The source says No source to compare with.
No source givenQuote
CISA advised organizations that cannot update, or that still run unsupported PHP 8.1 or earlier, to take PHP-based systems offline until patched or upgraded.
The article gives no link or citation for it.
The article says “CISA advised organizations that cannot update, or that still run unsupported PHP 8.1 or earlier, to take PHP-based systems offline until they are patched or upgraded”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 1 pts, not on front page
Recorded for context only, checked 26 Oct 2026, 07:27 UTC. It played no part in the ranking.