<?php Live statistics
PHP2Shell in numbers
Aggregated results of the checks run on this site: which PHP versions sites advertise, how many are fixed and where they are hosted. Individual sites are never shown.
Updated 2026-10-24 10:56 UTC · refreshed every 5 minutes
Where checked sites are hosted
Each point is a country: its size shows the number of checks, its colour the most common result. Drag to rotate.
- Fixed
- Affected / End of life
- Distribution build
- Version hidden
Results
All checks by result.
- Fixed128
- Affected65
- End of life169
- Distribution build9
- Version hidden34
- Unknown484
Checks per day
By result (UTC).
Fix adoption by PHP branch
Share of sites on each branch that advertise the fixed release.
Most common versions seen
| Version | Branch status | Checks |
|---|---|---|
8.3.36 | Fixed | 50 |
7.4.33 | End of life | 45 |
8.2.35 | Fixed | 29 |
8.5.12 | Fixed | 27 |
8.3.35 | Affected | 24 |
5.6.40 | End of life | 22 |
8.4.27 | Fixed | 22 |
8.1.34 | End of life | 15 |
8.2.34 | Affected | 15 |
8.0.30 | End of life | 11 |
7.2.34 | End of life | 9 |
7.1.33 | End of life | 8 |
7.3.33 | End of life | 8 |
8.5.11 | Affected | 5 |
5.4.16 | End of life | 4 |
8.4.26 | Affected | 4 |
5.5.9-1ubuntu4.29 | Distribution build | 3 |
7.2.24 | End of life | 3 |
5.3.10-1ubuntu3.48 | Distribution build | 2 |
5.3.3 | End of life | 2 |
How much do sites reveal?
Among checks where the site answered.
How far behind the fix?
Sites on supported branches, by how many patch releases they are behind the fixed version.
- On the fix or newer
- 1 release behind
- 2–5 releases behind
- 6 or more behind
PHP 8.1 and older have no official fix and are not shown here.
Which PHP branches are out there
Share of each branch among sites that show a version. Dark red: end of life.
Networks
Hosting network (autonomous system) of the checked sites.
| Network | Checks | Version shown | Affected |
|---|---|---|---|
| Cloudflare, Inc. AS13335 | 291 | 95 | 56 |
| Amazon.com, Inc. AS16509 | 66 | 12 | 6 |
| Hostinger International Limited AS47583 | 35 | 32 | 32 |
| OVH SAS AS16276 | 24 | 5 | 1 |
| Hetzner Online GmbH AS24940 | 21 | 7 | 2 |
| Fastly, Inc. AS54113 | 14 | 0 | 0 |
| Google LLC AS396982 | 14 | 6 | 3 |
| Microsoft Corporation AS8075 | 12 | 1 | 0 |
| IONOS SE AS8560 | 11 | 10 | 5 |
| Amazon.com, Inc. AS14618 | 11 | 4 | 2 |
| DigitalOcean, LLC AS14061 | 9 | 5 | 1 |
| Cloudflare London, LLC AS209242 | 9 | 0 | 0 |
| Hangzhou Alibaba Advertising Co.,Ltd. AS37963 | 8 | 2 | 2 |
| Beget LLC AS198610 | 8 | 6 | 3 |
| Oracle Corporation AS31898 | 7 | 1 | 1 |
Web server software
From the Server response header. A CDN name means the real server is hidden behind it.
| Server | Checks | Version shown |
|---|---|---|
| Cloudflare | 297 | 95 |
| nginx | 182 | 94 |
| Apache | 148 | 97 |
| LiteSpeed | 60 | 42 |
| Other | 52 | 18 |
| Microsoft IIS | 14 | 9 |
| OpenResty | 13 | 4 |
| CloudFront | 8 | 0 |
| DDoS-Guard | 7 | 2 |
| Vercel | 4 | 0 |
By hosting country
Country of the server’s IP address.
| Country | Checks | Fixed | Affected | Version hidden |
|---|---|---|---|---|
| Canada | 315 | 39 | 56 | 207 |
| United States | 116 | 14 | 21 | 72 |
| Germany | 102 | 13 | 15 | 71 |
| Russia | 59 | 8 | 16 | 26 |
| France | 28 | 5 | 4 | 17 |
| Netherlands | 28 | 6 | 7 | 15 |
| United Kingdom | 18 | 2 | 3 | 11 |
| Turkey | 16 | 2 | 5 | 6 |
| Brazil | 15 | 4 | 5 | 6 |
| Singapore | 15 | 1 | 9 | 5 |
| India | 14 | 1 | 5 | 7 |
| Italy | 13 | 2 | 4 | 5 |
| Lithuania | 13 | 0 | 12 | 1 |
| China | 11 | 0 | 4 | 2 |
| Japan | 10 | 2 | 3 | 5 |
| Spain | 9 | 3 | 6 | 0 |
| Poland | 9 | 2 | 1 | 6 |
| Czechia | 8 | 2 | 1 | 4 |
| Iran | 8 | 0 | 3 | 5 |
| Vietnam | 8 | 1 | 6 | 1 |
The internet-wide picture
Source: Censys internet-wide scans, php2shell.censys.com (2026-10-23 07:15 UTC). These figures are theirs, not ours.
How these numbers are made: every check run on this site is counted once, by the version the site advertised at that moment. Sites that hide their version count as “version hidden”. Version numbers are evidence, not proof — distributions may patch without changing them. Hosting country comes from a local IP database (DB-IP); no site names or IP addresses are published. Network names come from DB-IP’s IP to ASN Lite database.