Composer installs on Packagist have moved much faster, with only 10.05% on those older branches in September 2026, against 34.51% of WordPress sites. That gap suggests the slow tail sits with hosting setups many WordPress owners do not choose or control themselves.
Is PHP still relevant in 2026?
PHP remains one of the most widely used server-side languages on the web, powering content management systems, shared hosting platforms, control panels and many applications that do not advertise their use of it. Armis notes that PHP powers WordPress, Drupal, Joomla and Magento, and that because PHP2Shell sits in PHP's core rather than in any single application, the number of places an organisation needs to check for vulnerable PHP is large.5
Censys, the cybersecurity search engine, found over 59 million WordPress sites visible on the internet, deployed across 1 million unique IP addresses, and noted that this content management system powers approximately 40% of the web.2 Security company Mallory counted about 884,000 internet-facing hosts whose HTTP banner reported a PHP version of 8.1 or older to the Shodan search engine on October 20, 59% of the roughly 1.5 million hosts that reported any version.4 Those numbers confirm that PHP's reach in 2026 is vast, and that its security posture directly affects a large share of the public internet.
Why are so many WordPress sites stuck on old PHP versions?
Compatibility with older plugins is the most commonly cited reason WordPress sites stay on outdated PHP. One WordPress admin described the problem plainly: "Whenever I bump PHP to the latest version, something on my site breaks, usually some dusty old plugin."2 Censys found that admins are more likely to be running up-to-date WordPress versions alongside end-of-life PHP, suggesting the PHP upgrade is the harder step.2
Censys points to a structural problem: "CMSes are not being designed with older backend frameworks in mind. Rather, they work under the assumption that users have the ability to maintain the latest versions of underlying backend software with no blockers or inhibitions."2 PHP itself compounds this by assuming users are upgrading from only one patch below, making jumps from very old versions difficult.2 The result, Censys warns, is that "updates can cause sites to become dysfunctional, resulting in users delaying updates."2 For many WordPress owners, the PHP version is set by their host, not by them, which adds another layer of friction.
Who is most at risk from unpatched PHP2Shell vulnerabilities?
Sites running Apache with mod_php face the greatest immediate danger. PHP's own advisory singles out mod_php as the highest risk, with a demonstrated exploit in which a single unauthenticated request triggers the attack before any application code runs.3 Every PHP installation serving web requests is affected, including PHP-FPM, php-cgi, FrankenPHP and LiteSpeed, but the mod_php path requires no action from the application at all.1
Beyond code execution, researchers demonstrated unauthenticated reading of live PHP worker memory against applications they did not control, exposing passwords, authentication tokens, API keys and certificates belonging to other requests.3 Sites on PHP 8.1 or older are in a worse position because they receive no official fix from the PHP project. Computer forensics expert Hal Pomeranz described the likely outcome: "So many embedded installations out there that will never be patched. Too many forgotten, unmaintained apps. There will be a long tail for this one."1 The php 8.1 end of life date was December 31, 2025, and the php 7.4 end of life date was November 28, 2022, meaning those branches have been outside regular support for months or years.
How long will PHP 8.2 be supported?
PHP 8.2 reaches end of life on December 31, 2026, after which it will receive no further security fixes from the PHP project.3 It currently runs on 24.23% of WordPress sites, making it the second most common branch after PHP 8.3 at 27.27%.
The table in The Hacker News confirms the support timeline: PHP 8.2 and 8.3 are currently in security-fixes-only mode, while PHP 8.4 and 8.5 remain in active support until December 31, 2026 and December 31, 2027 respectively.3
What do security experts say about sites that cannot be patched quickly?
Security experts are consistent that configuration changes and firewall rules are not a substitute for patching. PHP core developer Gina Peter Banyard was direct before the release: "The only thing I can say is that the only mitigation is patching/upgrading PHP. I sadly know too much."3 The Hacker News confirmed that the session.upload_progress workaround circulated before the patch "was never a complete fix" and does nothing for CVE-2026-109618.3
For sites that cannot be patched immediately, the UK's National Cyber Security Centre is urging organisations to consider taking offline any system that cannot be fixed right away.1 CISA advised organisations still on PHP 8.1 or earlier to take those systems offline until they are patched or updated. Armis recommends isolating or disabling externally accessible PHP services that cannot be updated, and capturing volatile evidence before restarting workers, because restarting wipes the in-memory state that CVE-2026-109619 abuses.5 Cloudflare CTO Dane Knecht described the firewall rules his company deployed as a stopgap and urged administrators to patch, noting: "We are seeing early attacks emerging and are updating mitigations as new vectors show up."3