❌

Normal view

Received — 22 October 2026 ⏭

Sizing the PHP exposure window for CVE-2026-109618 and CVE-2026-109619 with VirusTotal

✇VirusTotal Blog
By: Joseliyo Sánchez
21 October 2026 at 12:12
On October 20, the PHP security team announced an out-of-band security release for Wednesday, October 21, 2026 at 14:00 UTC, fixing two critical vulnerabilities rated CVSS v4.0 9.2 (CVE-2026-109618 and CVE-2026-109619). Hours before the release, technical details leaked publicly. They point to the session.upload_progress feature, which has been part of PHP since 5.4.0 and is enabled by default. The community quickly converged on an interim mitigation: set session.upload_progress.enabled = Off in php.ini.
That leaves defenders with two questions: how big is the exposed surface, and where should they start? We used Internet Scanning in VirusTotal to answer both.
Note: Official details, affected versions and fixed versions are published by the PHP project with the release. The figures below describe the Internet-facing PHP footprint, not confirmed vulnerable hosts.

Most PHP servers don't say they are PHP

VirusTotal fingerprints roughly 5.1 million IP addresses running PHP (port_service_cpe:php), about 3.8 million of them with at least one port open today. Only around 1.1 million of those announce a version in an HTTP header such as X-Powered-By: PHP/8.3.35.
In other words, roughly four out of five PHP servers hide their version (expose_php = Off, stripped headers, reverse proxies). VirusTotal still identifies them as PHP through other signals: the application on top (WordPress, Laravel, Nextcloud...), PHPSESSID cookies and framework-specific headers. If you only search for a version string, you only see the fraction of the problem that volunteers it.

The version picture: the long tail of end-of-life PHP

Among the servers that do disclose their version, the split is stark:
PHP versions disclosed in service banners: supported, end-of-life and pre-5.4 branches

  • ~272K run a supported branch (8.2 to 8.5), the only branches that receive security fixes from the PHP project.
  • ~758K run an end-of-life branch between 5.4 and 8.1. These branches have session.upload_progress enabled by default and no longer receive security fixes. PHP 7.4 alone accounts for ~187K IPs and PHP 5.4 for ~119K.
  • ~88K run PHP 5.2 or 5.3, which predate session.upload_progress.
Being up to date doesn't buy much time either: about 85K IPs run the exact releases published on September 24 (8.3.35, 8.2.34, 8.4.26 and 8.5.11), the latest available before this fix.
Latest PHP releases before the fix and other open ports on PHP hosts

What runs on top, and where

Apache (~2.9M) and nginx (~1.48M) are the web servers most often seen on PHP hosts, followed by LiteSpeed (~90K). On the application side, WordPress dominates with ~538K IPs, followed by Laravel (~141K) and Nextcloud (~107K). Webmail (Roundcube) and database admin panels (phpMyAdmin) add another ~25K high-value targets.
Web servers and applications detected on PHP hosts

The geography is concentrated: the United States accounts for ~920K PHP hosts with at least one open port, and a handful of cloud and hosting providers (AWS, DigitalOcean, Alibaba, OVHcloud, Hetzner) concentrate a large share. That concentration is good news for remediation: a few providers that push a configuration change or a WAF rule can cover a lot of ground.
Top countries and selected hosting providers for PHP hosts with an open port

Going beyond the web port

PHP rarely travels alone. ~394K PHP hosts also have port 22 open (SSH by default), ~233K port 3306 (MySQL) and ~68K port 3389 (RDP). Those co-exposed services are useful for something else: identifying the exact build behind the web server.
The leaked material references LiteSpeed lsphp82 8.2.34 builds for Debian 12, Ubuntu 22.04 and Ubuntu 24.04, and notes that HTTP headers alone don't tell those builds apart. The OpenSSH package on port 22 does. With the bracket syntax, every condition is pinned to its port:
entity:ip port_service_cpe:php port_banner:"PHP/8.2.34" port_service_version[22]:"9.6p1 Ubuntu"
Of the ~3.5K IPs whose banners show both LiteSpeed and PHP 8.2.34, about 500 also have port 22 open. Across all PHP 8.2.34 hosts, the OpenSSH package on port 22 matches Ubuntu 24.04 on 269 IPs, Ubuntu 22.04 on 112 and Debian 12 on 65. For a defender, that is the difference between "patch everything" and "these are the machines that match the leaked target profile, patch them first". Keep in mind that port 22 reveals the host operating system: PHP may still run inside a container built on a different base image.
Ports tab of a PHP 8.2.34 host showing HTTP and OpenSSH on port 22

Adversaries run PHP too

The exposed surface also includes attacker infrastructure. Around 5.7K PHP hosts with at least one open port have five or more detections in VirusTotal, 729 of them disclosing PHP 8.x. One of them is an old acquaintance: the NOX Stealer panel (rebranded as BOMBAY) on 5.175.221[.]206:8443, which we profiled in our Internet Scanning post, runs nginx 1.24.0 with PHP/8.3.33.
Ports tab of 5.175.221.206 showing nginx 1.24.0 and PHP/8.3.33 on port 8443

What the VirusTotal corpus saw

The leak left traces across VirusTotal. The archive referenced in the write-up was first submitted at 02:29 UTC on October 21, less than 15 minutes after the first submission of the write-up URL. By the time of writing, 21 crowdsourced reports covering the vulnerabilities had been ingested as collections. Following entity:collection collection_type:report "CVE-2026-109618" is the fastest way to keep up with new reporting as it appears.
VirusTotal search results for crowdsourced reports about CVE-2026-109618

What to do now

  1. Patch. Upgrade to the fixed release of your branch (8.2, 8.3, 8.4 or 8.5) as soon as it is available on php.net or through your distribution.
  2. Plan the EOL migration. PHP 8.1 and older no longer receive security fixes. If you are on 5.4 to 8.1, upgrade the branch or check whether your distribution or vendor ships a backport.
  3. Disable upload progress until you patch. Set session.upload_progress.enabled = Off in php.ini (or the pool configuration) and reload PHP-FPM, Apache or LSAPI. It only breaks upload progress bars that rely on the feature. Community analysis suggests it may not cover every vector, so treat it as a stopgap, not a fix.
  4. Filter multipart at the edge. Where an application doesn't need file uploads, block or inspect multipart/form-data requests before they reach PHP. Cloudflare shipped emergency rules to its Managed and Free rulesets on October 21, and its CTO stated that they cover known payloads, while stressing that only updating PHP fully protects a site.
  5. Make sure the WAF can't be bypassed. Edge rules only help if the origin is not directly reachable. Search your own ranges in VirusTotal (for example, entity:ip port_service_cpe:php asn:<your ASN>) to find origins that expose PHP directly to the Internet.
  6. Don't rely on hiding the version. expose_php = Off hides the header, not the vulnerability.

Queries used in this post

Query What it finds
entity:ip port_service_cpe:php All IPs where VirusTotal fingerprinted PHP on any port
entity:ip port_service_cpe:php port_status:open PHP hosts with at least one port currently open
entity:ip port_service_cpe:php port_banner:"PHP/" PHP hosts that disclose their version in an HTTP header
entity:ip port_service_cpe:php port_banner:"PHP/7.4." PHP hosts on a given branch (repeat for each branch from 5.2 to 8.5)
entity:ip port_service_cpe:php port_banner:"PHP/8.3.35" PHP hosts on the latest release before the fix (repeat for 8.2.34, 8.4.26 and 8.5.11)
entity:ip port_service_cpe:php port_service_cpe:nginx PHP hosts by web server (also "apache:http_server", lighttpd, internet_information_services)
entity:ip port_service_cpe:php port_banner:"LiteSpeed" PHP hosts by Server header (also openresty, Caddy)
entity:ip port_service_cpe:php port_service_cpe:wordpress PHP hosts by application (also laravel, nextcloud, drupal, joomla, roundcube, phpmyadmin...)
entity:ip port_service_cpe:php port_status:open country:US PHP hosts with an open port, by country
entity:ip port_service_cpe:php port_status:open asn:16509 PHP hosts with an open port, by hosting provider ASN
entity:ip port_service_cpe:php open_port:22 PHP hosts with another port open (also 3306, 3389, 445, 8443, 8000)
entity:ip port_service_cpe:php port_banner:"LiteSpeed" port_banner:"PHP/8.2.34" Hosts whose banners show both LiteSpeed and PHP 8.2.34, the profile referenced in the leak
entity:ip port_service_cpe:php port_banner:"PHP/8.2.34" port_service_version[22]:"9.6p1 Ubuntu" PHP 8.2.34 hosts whose OpenSSH package on port 22 is Ubuntu 24.04's (use 8.9p1 Ubuntu for Ubuntu 22.04 and deb12 for Debian 12)
entity:ip port_service_cpe:php port_status:open positives:5+ PHP hosts with an open port and five or more detections
entity:collection collection_type:report "CVE-2026-109618" Crowdsourced reports about the vulnerabilities
Note: All counts in this post were taken on October 21, 2026. For large result sets VirusTotal returns estimated totals that vary between runs, so we report the median of seven runs, rounded. Port modifiers without a port in brackets match per IP, not per port: port_service_cpe:php port_status:open means PHP was fingerprinted on the IP and at least one of its ports is open.

References

Happy hunting!

❌