Global – October 27, 2026 -- Five days after the PHP project shipped emergency fixes for the PHP2Shell flaws, 93.6% of measurable PHP instances remain exposed, according to OX Security scans run through October 26, 2026. That is roughly 15 of every 16 hosts the firm can measure.