PHP2Shell in the Baltics
Notes & limitations
- Counts are services that state their PHP version in HTTP response headers. Many sites hide it, so the real numbers are higher.
- Services that run PHP without stating a version are left out unless “Include unknown versions” is on; their status cannot be told.
- Vendor builds (operating system packages) may carry backported fixes without changing the version number; they are shown separately, not as affected.
- A service is a website (one name) or, where no name is known, an address and port; one address can host many sites.
- Data is updated hourly; a day is final at 00:00 UTC. The daily charts start on 2026-10-26, the first full day of rechecks.
- Branches older than 8.2 get no official fix and are counted as affected.
- A backported build still reports its original version in HTTP headers (for example PHP/5.4.16), so this page counts it as affected or as a vendor build: it cannot tell patched backports apart. Backported fixes for end-of-life branches: rh.cloud.lt; verify a server with its php2shell-verify script.
- Found a mistake? Contact us and we will correct it.