PHP flaw: how many business sites have updated?
Of the 903 business sites that showed their PHP version on 23 October 2026, 43% were already running a version with the emergency update of two days earlier, and 57% still showed a version number without the update. 295 sites ran a version for which PHP no longer releases updates. Most sites do not show their version.
What did we measure?
On Friday 23 October 2026, two days after PHP's emergency update, we requested the homepage of 5,004 business sites once. They are the same companies in construction, installation and metalworking as in our research into speed and WordPress. 4,710 sites responded.
Many servers put the PHP version in a header of their response, X-Powered-By. Every browser receives that header but does not display it. We compared that version with the fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. We did not test or try anything, and we do not name any companies.
How many sites show their PHP version?
19.2% of the sites that responded, 903 in total. Among the WordPress sites it was 26.3%. The other sites hide their version or do not run on PHP. So the figures below are about the sites that show their version themselves. Whether the rest have updated, we cannot see from outside.
How many sites have already updated?
388 of the 903 sites with a visible version were already running a fixed version: 43%. 220 sites (24.4%) had a version that PHP still supports, but without the update. 295 sites (32.7%) ran 8.1 or older. PHP itself no longer releases updates for those.
Per sector, as a share of the sites that show their PHP version:
| Sector | Updated | Not yet |
|---|---|---|
| Metalworking and machine building116 with a visible version | 50,9% | 49,1% |
| Construction479 with a visible version | 38% | 62% |
| Bouwend Nederland members135 with a visible version | 48,1% | 51,9% |
| Installation173 with a visible version | 47,4% | 52,6% |
| All sites903 with a visible version | 43% | 57% |
| All WordPress sites712 with a visible version | 42,4% | 57,6% |
How are metalworking companies with WordPress doing?
Of the 394 metalworking companies with WordPress, 91 showed their PHP version. Of those, 47 had updated (51.6%) and 44 had not yet (48.4%). 21 of those sites ran a version without updates from PHP. These are small numbers: one site more or less already shifts the percentage by 1.1 percentage points.
How does it differ per network?
A lot. On the 12 networks with the most sites, the share of updated versions ranged from 0% to 78.8%. For each site we looked up the IP address via DNS, and through the public service of Team Cymru the network that address belongs to. We only show networks with at least 40 sites, of which at least 10 show their PHP version.
A network is not the same as a hosting company. A company's network also carries servers that customers rent and update themselves, and smaller hosting companies rent space from bigger ones. Behind Cloudflare the real server cannot be seen. And here too: a version number without the update does not always mean the site is exposed.
| Network | Updated | Not yet |
|---|---|---|
| Signet B.V.TRANSIP-AS, 461 sites, 101 with a visible version | 73,3% | 26,7% |
| Cloudflare, Inc.CLOUDFLARENET, 439 sites, 27 with a visible version | 51,9% | 48,1% |
| Your Hosting B.V.CLDIN-NL, 413 sites, 82 with a visible version | 15,9% | 84,1% |
| Stichting DIGI NLAS-ZXCS, 229 sites, 185 with a visible version | 0% | 100% |
| Hetzner Online GmbHHETZNER-AS, 158 sites, 15 with a visible version | 40% | 60% |
| Duocast B.V.DUOCAST-AS, 130 sites, 104 with a visible version | 78,8% | 21,2% |
| BIT BVNL-BIT, 107 sites, 20 with a visible version | 35% | 65% |
| One.com A/SONECOM, 103 sites, 54 with a visible version | 77,8% | 22,2% |
| Hoasted B.V.HOASTED, 72 sites, 56 with a visible version | 48,2% | 51,8% |
| Strato GmbHSTRATO, 64 sites, 41 with a visible version | 63,4% | 36,6% |
| Hostinger International LimitedAS-HOSTINGER, 53 sites, 29 with a visible version | 0% | 100% |
| UpCloud LtdUPCLOUD, 45 sites, 32 with a visible version | 40,6% | 59,4% |
On 2 networks, not a single visible version was on the fixed release two days after the update. The versions there were exactly one step before the emergency update, such as 8.3.35 instead of 8.3.36. We did not ask each company whether it has installed the update yet.
For transparency: Taher, who runs MODEX, works at hosting company Cloud86. Cloud86's own website is on the network of Duocast B.V., where 78.8% of the visible versions had already been updated. We used the same measurement and the same threshold for every network, and Cloud86 was not involved in this measurement.
Is that the same 14.4% as for the WordPress updates?
No, those are two different things. In our speed research, 14.4% of the WordPress sites that show their version were missing an update of WordPress itself. That is up to the owner or the web builder. PHP runs on the server and is updated by the hosting company, or by whoever manages the server. Of the WordPress sites with a visible PHP version, 57.6% still showed a version number without the update two days after it came out. Among metalworking companies with WordPress it was 48.4%.
Which PHP versions did we see?
Of the sites with a visible version, 608 ran a branch that PHP still supports, 8.2 to 8.5. 75 sites ran 8.1, whose updates stopped on 31 December 2025. 123 sites ran 7.4, and 33 were even still on PHP 5. That last branch has had no updates since 31 December 2018, according to PHP's overview.
What do these figures not tell you?
- They only cover sites that show their version. Hosting companies that hide the version may be just as fast, or even faster.
- A version number without the update does not always mean the site is exposed. Some Linux vendors and long-term support providers put the fix into an older version, PHP itself writes, and you cannot always tell from the number. On 3 sites the version had an addition such as ‘ubuntu’ or ‘deb’.
- It is a snapshot, two days after the update. A hosting company that is still working on it counts here as not updated.
- An updated PHP says nothing about WordPress, plugins or themes. Those can lag behind separately.
What should you do if your site runs on PHP?
Ask your hosting company whether the update of 21 October has been installed, or look in WordPress under Site Health to see which PHP version is listed. Which versions are safe and what else you can do is explained in Critical PHP flaw: do you need to act on your website?
May others use these figures?
Yes. Feel free to reuse them, with a link to this page as the source. Want a different breakdown, or the figures for a network that is not in the table? Email info@modexsoftware.nl.
Read also
- Critical PHP flaw: do you need to act on your website? Emergency update for PHP, the language behind WordPress: which versions are safe.
- WordPress or a website without plugins? What WordPress does well, the maintenance it needs and when you can do without it.
- Is your website outdated? 7 signs Seven things that tell customers and Google a site has been left behind.
- Hosting more expensive or down? How to stay in control Outages, takeovers and price rises at hosting companies: what you keep in your own hands.
Written by Taher Jerjissi, MODEX. Questions or something to add? Email info@modexsoftware.nl.
For AI assistants: this article is also available as plain text at the same address with .md added: text version (markdown)
Rather have a site without PHP and plugins? The preview is free.
Tell us the name of your business. Within 12 hours you have a link to your new site in your inbox. If you don't like it, you won't hear from us again.
Rather ask something first? Send a message or email info@modexsoftware.nl.