PHP2Shell and New York business websites: what 10,226 sites report
We ran the same passive check our free tool runs, on every business website we could find in the Capital Region and the New York City metro, the day the fix came out. Here is what the servers said.
On October 21, 2026, the day the PHP2Shell fix was released, we checked the websites of 10,226 businesses across the Capital Region and the New York City metro. 42% run PHP. Of the sites that reveal their PHP version, 95% reported an affected release and 47% were on a branch with no official release any more. Only 35 sites, 0.4% of all reachable sites and 4.6% of those revealing a version, reported a fixed release.
What the sites report
Every site was visited once, the way a browser visits it, and classified from what the server said. 9,527 of the 10,226 loaded; the other 699 were unreachable that day. Percentages below are of the 9,527 reachable sites.
| Verdict | Capital Region | NYC metro | Combined (unique) |
|---|---|---|---|
| Business websites checked | 2,879 | 7,381 | 10,226 |
| Loaded (reachable) | 2,552 | 7,009 | 9,527 |
| Run PHP | 1,041 (40.8%) | 3,018 (43.1%) | 4,045 (42.5%) |
| At risk: old PHP, no official release | 66 (2.6%) | 290 (4.1%) | 356 (3.7%) |
| At risk: supported branch, not yet updated | 85 (3.3%) | 279 (4.0%) | 364 (3.8%) |
| Runs PHP, version hidden | 888 (34.8%) | 2,416 (34.5%) | 3,290 (34.5%) |
| Reports a fixed release | 2 (0.1%) | 33 (0.5%) | 35 (0.4%) |
| No PHP seen | 1,511 (59.2%) | 3,991 (56.9%) | 5,482 (57.5%) |
Percentages are of reachable sites in each column. “Run PHP” is the sum of the four PHP rows. The combined column counts each website once: 34 businesses appeared in both regional lists, so the regional columns add up to slightly more than the combined one.
The versions sites admit to
755 sites, about one in thirteen, announce their PHP version in a response header. That group is the only one where the verdict is exact, and it is bleak: 720 of the 755 reported an affected release. The branches that no longer get official releases dominate.
WordPress is most of it
Of the 4,045 sites that run PHP, 3,457 (85%) are WordPress. That is the practical shape of the problem for a local business: the fix is not a WordPress update, it is a PHP update at the host, and most owners have never changed that setting or heard of it. The remainder are Joomla, Drupal, Magento, PrestaShop, OpenCart and custom PHP sites.
What it means
- Most owners can't tell from the outside. Eight in ten PHP sites hide their version, which is the right setting, but it means the owner has to ask the host. Most won't unless prompted.
- Where we can see, almost nobody had updated yet. 35 fixed sites out of 755 on the day of the release. That gap closes over the following weeks for sites someone maintains; it does not close for sites nobody maintains.
- Half the visible at-risk sites can't be patched in place. They are on PHP 8.1 or older, where the only route is a distribution backport or moving to a supported branch. That is a small job on a maintained site and a real job on an abandoned one.
Methodology
Businesses were found through public Google Maps listings for the Capital Region (Albany and surrounding counties) and the New York City metro (Westchester, the Bronx and surrounding areas, centred on Yonkers), across several dozen business categories, excluding automotive. Each listed website was visited once on October 21, 2026 with an ordinary browser-style request to its homepage, following redirects. The classification reads three things from the response: a PHP version announced in the X-Powered-By or Server header, a PHP session cookie, and the platform seen in the page (WordPress and other PHP applications; Wix, Squarespace, Shopify, Webflow, GoDaddy Website Builder, Weebly and Duda as hosted platforms). Counts are unique websites: a business listed twice, or in both regions, counts once.
Limits: a reported version is what the server says, not proof. A host that backports fixes without changing the version string will read as at risk when it is not, so the “at risk” figures are an upper bound for those sites, and the “version hidden” group contains an unknown mix. Unreachable sites (699) are excluded from percentages. No site was tested, probed or logged into; the check is the same one anyone can run at remidiy.com/php-vulnerability-checker.
No business is named in this report, and we will not name any. Journalists and researchers who want the aggregate tables in spreadsheet form, or a breakdown by category or county, can write to [email protected].
Check your own site
The same check, on one address, in a few seconds.
Read what PHP2Shell is and what to do, or jump straight to updating PHP on a WordPress site.