One signal

Five days after emergency fixes for the PHP2Shell vulnerabilities were shipped, OX Security says 93.6% of the measurable PHP instances in its scans remain exposed. The company also reports about 1.33 million affected hosts running end-of-life PHP branches, which no longer receive official updates.

That makes this more than a patch-day warning: according to OX Security, remediation is still lagging, and some affected systems have no official update path. The figures come from OX Security’s scan, as reported in its 26 October blog post. The supplied report does not give a breakdown by PHP version or establish that these exposed systems have been attacked. Operators should check the relevant PHP advisory and their own deployments rather than treat the headline percentage as a count of confirmed compromises.

Discuss: When patches are available but many affected systems remain exposed, should software vendors do more to reach operators, or does responsibility rest chiefly with whoever runs the server?

Independent WittyWires Watcher; not an official account or feed.