After the PHP2Shell disclosure in October 2026, the useful question stopped being "how many servers run PHP" and became "how many run a version that will never receive a fix". The index answers that more directly than most people expect, because a surprising number of servers still volunteer their version in a response header.

What the header reveals

Queries against the ZoomEye index on 28 October 2026:

  • app="PHP" returns 111,072,293 matches, and app="PHP" && port=443 returns 22,706,573.

  • http.header="X-Powered-By: PHP" returns 46,709,646.

  • http.header="X-Powered-By: PHP/7.4" returns 2,650,830.

  • http.header="X-Powered-By: PHP/8.1" returns 530,860.

  • http.header="X-Powered-By: PHP/8.2" returns 796,916.
    The version-specific counts are the most interesting numbers here, and they invert the intuition. PHP 7.4 and 8.1 are end-of-life branches. PHP 8.2 is a supported branch that received a fix. Yet 7.4 shows up more than three times as often as 8.2, and more than five times as often as 8.1.

What that ratio means and does not mean

X-Powered-By is optional. Production hardening guides have told people to remove it for a decade, and many have. So every number above is a floor, and the population that hides its version is invisible to this method entirely.
That biases the sample in a specific direction worth naming: servers that still emit a version header are, on average, less carefully hardened than the ones that do not. Which makes the 7.4-to-8.2 ratio a conservative signal. Among servers that reveal something at all, the ageing branch dominates.
This is the practical form of the finding in the PHP2Shell analysis: 8.1 and earlier received source patches but no official binaries, and 7.x and below received nothing. A host advertising 7.4 is not "behind on patching". It is on a branch where the concept of being caught up no longer exists.

The distribution that matters for planning

Site counts do not equal organisation counts. One hosting provider's shared platform can present hundreds of thousands of domains on a single kernel and a single runtime build. That is why app="PHP" at 111 million and X-Powered-By at 46 million describe different things: the first is largely a proxy for "a web service exists here", the second is a subset that discloses a runtime identity.
For an asset owner the useful query is local and much smaller. Take your own address space, request the headers, and count how many distinct runtime versions you actually serve. Most organisations discover more versions than they expected, because the estate accumulated through acquisitions, side projects, vendor appliances and forgotten internal tools, and each has its own runtime.
The number that should concern a reader is not two and a half million. It is the count of versions in their own estate that no one is responsible for upgrading.

What can be done for hosts that cannot be upgraded

The realistic options for an end-of-life PHP host are unchanged and unpopular: take it off the public internet, put it behind a proxy that terminates and inspects, or retire it. Vendor backports exist for specific platforms — cPanel and CloudLinux shipped fixes for their PHP packages — and those cover a meaningful share of shared hosting. They do not cover a custom build on a VM that someone set up in 2019.
The detection angle is worth restating because it is cheap. CrowdStrike's published analysis of PHP2Shell describes exploitation leaving no application-level trace: the worker survives, the server returns HTTP 200, and the only artefact is a memory-limit fatal error in the web server log. An environment that does not alert on that line has no visibility into this class of attack at all.

The uncomfortable generalisation

Any runtime that advertises its version on every response is telling an attacker where to start. That used to be treated as a low-severity information disclosure, worth a note in a hardening checklist and nothing more. In a period where a pre-authentication runtime flaw can be weaponised within hours of disclosure, a version banner is a targeting signal with real value.
Removing the header does not make anyone safer. Not knowing your own version distribution does make you slower, and slower is now the expensive position.

References

  • ZoomEye search, queries executed 28 October 2026: app="PHP" 111,072,293; app="PHP" && port=443 22,706,573; X-Powered-By: PHP 46,709,646; PHP/7.4 2,650,830; PHP/8.1 530,860; PHP/8.2 796,916: https://www.zoomeye.org

  • FreeBuf report on PHP2Shell exploitation and detection characteristics, including CrowdStrike observations (22 October 2026): https://m.freebuf.com/news/508109.html

  • Wikipedia, PHP2Shell, for affected branches and fixed versions: https://en.wikipedia.org/wiki/PHP2Shell