Back to the trend of the day: Two PHP flaws let strangers seize websites; some went offline for safety
Poly Rating · from the trend of the day

How to Update PHP on My Website: 10 Platforms at Risk 2026

Updating WordPress does not fix this: WordPress.org says no WordPress update is planned. 24 hours after the PHP fix, 99.1% of affected WordPress hosts in a Shodan sample still ran unpatched PHP.

  • No. 1: WordPress
  • 10 places

01Final list

The leading AIs each built their own list of ten independently. Here is one result that is easy to check: every place has a reason, a source, and the list of AIs that included it.

Order: from most to least AI agreement.

A bright badge means this AI put the entry on its list. A dim badge means it did not.

  1. 1

    WordPress

    The biggest exposure. About 1 in 3 installs run PHP 8.1 or older; readings range from 32.4% to 36.4%. 33,075 affected hosts in a Shodan sample, only 299 patched.

    Included it: Claude, ChatGPT, Grok, Nemotron, Gemini, Kimi, Wenxin.

    In their lists: Claude: 5 · ChatGPT: 1 · Grok: 1 · Nemotron: 1 · Gemini: 1 · Kimi: 1 · Wenxin: 1

    What each AI noted 7
    • Claudeplace 5

      About 1 in 3 WordPress installs report PHP 8.1 or older, and WordPress.org said no WordPress update is planned: the PHP update is the fix.

      Source ↗
    • ChatGPTplace 1

      The world's most widely used CMS cannot patch the PHP engine through the ordinary WordPress core-update button.

      Source ↗
    • Grokplace 1

      Even a fully patched WordPress site stays exposed until the host upgrades the PHP engine underneath it

      Source ↗
    • Nemotronplace 1

      ~60% of WordPress sites run on EOL PHP per WP.org stats, but 1-click PHP switch exists on most managed hosts

    • Geminiplace 1

      Over 40 million updated sites show green checkmarks in wp-admin while quietly running on end-of-life PHP 7.4 or 8.0 engines underneath.

      Source ↗
    • Kimiplace 1

      Two of every five websites on Earth run it — and one in three still reports an end-of-life PHP, while the fully-updated WordPress 7.1.2 was on the researcher's own exploit demo list.

      Source ↗
    • Wenxinplace 1

      Nearly 4 in 10 sites run on it, yet a single dashboard click can switch the PHP engine if the host allows it — but 18 % of installs still report PHP 7.x or below

    7 AIs put it here
    Source ↗
  2. 2

    Drupal

    Nearly half of Drupal sites already run an end-of-life core (29% on Drupal 7 alone). Only 31 of 3,919 affected hosts were patched after a day.

    Included it: Claude, ChatGPT, Grok, Nemotron, Gemini, Kimi, Wenxin.

    In their lists: Claude: 3 · ChatGPT: 3 · Grok: 2 · Nemotron: 2 · Gemini: 3 · Kimi: 4 · Wenxin: 2

    What each AI noted 7
    • Claudeplace 3

      Wiz showed remote code execution against the latest Drupal image, so an up-to-date core gave no protection.

      Source ↗
    • ChatGPTplace 3

      Drupal documents a hard boundary: no supported Drupal release supports PHP 7, yet upgrading Drupal still does not patch PHP itself.

      Source ↗
    • Grokplace 2

      About half the detected Drupal sites already run end-of-life majors, and PHP underneath is equally outside the platform’s updater

    • Nemotronplace 2

      Drupal 10+ requires PHP 8.1+, but Drupal 7 sites (still ~15% of installs) stuck on PHP 7.4 EOL

      Source ↗
    • Geminiplace 3

      A severe divide exists where Drupal 7 enterprise holdouts preserve PHP 7.4 runtimes despite Drupal 10 demanding modern PHP 8.2+.

      Source ↗
    • Kimiplace 4

      Nearly half of all Drupal sites still run an end-of-life core — 29% are on Drupal 7 alone, dead since January 2025 — so their PHP is usually even older.

    • Wenxinplace 2

      Updater can change the platform but cannot touch the PHP engine — 22 % of Drupal sites sit on EOL PHP because the host never upgraded

      Source ↗
    7 AIs put it here
    Source ↗
  3. 3

    Joomla

    Only 4 of 646 affected Joomla hosts had patched PHP after 24 hours. Joomla.org itself went offline, and current Joomla 6.1.4 was exploited in a demo.

    Included it: Claude, ChatGPT, Grok, Nemotron, Gemini, Kimi, Wenxin.

    In their lists: Claude: 4 · ChatGPT: 2 · Grok: 3 · Nemotron: 3 · Gemini: 2 · Kimi: 2 · Wenxin: 3

    What each AI noted 7
    • Claudeplace 4

      Only 4 of the 1,099 Joomla hosts in the OX sample showed a patched PHP after a day.

      Source ↗
    • ChatGPTplace 2

      An up-to-date Joomla dashboard can coexist with an outdated PHP engine underneath it.

    • Grokplace 3

      Smaller footprint than WordPress yet the same host-controlled PHP barrier for any site that wants the October 2026 fixes

      Source ↗
    • Nemotronplace 3

      Joomla 5.x needs PHP 8.2+; 4.x on 8.1; many 3.x sites still on PHP 7.4 with no core upgrade path

      Source ↗
    • Geminiplace 2

      Nearly half of production deployments run legacy PHP because extensions break immediately upon stepping onto PHP 8.2 or 8.3.

    • Kimiplace 2

      82% of Joomla sites still run version 3 — software that works fine on PHP from 2012 — and the Joomla project's own website went offline over this bug.

      Source ↗
    • Wenxinplace 3

      One-click updater for Joomla itself, zero control over PHP — one in five Joomla installs still ships PHP 7.4

      Source ↗
    7 AIs put it here
    Source ↗
  4. 4

    Magento / Adobe Commerce

    None of the 48 affected Magento hosts in the sample were patched after a day. Sansec: 'you cannot fix PHP2Shell from within your store code.'

    Included it: Claude, ChatGPT, Grok, Nemotron, Gemini, Kimi, Wenxin.

    In their lists: Claude: 1 · ChatGPT: 4 · Grok: 4 · Nemotron: 4 · Gemini: 4 · Kimi: 3 · Wenxin: 4

    What each AI noted 7
    • Claudeplace 1

      In the OX sample, 48 visible Magento hosts were affected and none had been patched after 24 hours. A store's own updates never touch PHP.

      Source ↗
    • ChatGPTplace 4

      A runtime fix can become a coordinated commerce upgrade when the PHP version and the store's supported dependency stack must move together.

      Source ↗
    • Grokplace 4

      E-commerce installs that stay current on the platform can still sit on unpatched PHP until the server or host moves the runtime

      Source ↗
    • Nemotronplace 4

      Magento 2.4.7+ requires PHP 8.2+; older 2.4.x on PHP 8.1 EOL soon; Cloud auto-updates PHP

      Source ↗
    • Geminiplace 4

      Strict compiled dependency constraints mean upgrading the underlying PHP engine requires rebuilds, leaving e-commerce stores frozen on retired runtimes.

      Source ↗
    • Kimiplace 3

      Magento 1 stores have had no official security support since June 2020 — for them this emergency fix simply does not exist, only a server upgrade does.

      Source ↗
    • Wenxinplace 4

      Enterprise-grade platform but the updater only patches Magento code; PHP upgrade means calling the hosting company — 30 % of stores still on PHP 7.4

      Source ↗
    7 AIs put it here
    Source ↗
  5. 5

    Laravel and custom PHP apps

    No dashboard warns anyone, and no framework tool can change PHP. 98.27% of visible Laravel hosts were still unpatched after a day (36 of 2,040 affected patched).

    Included it: Claude, ChatGPT, Grok, Nemotron. Did not include: Gemini, Kimi, Wenxin.

    In their lists: Claude: 6 · ChatGPT: 5 · Grok: 5 · Nemotron: 6

    What each AI noted 4
    • Claudeplace 6

      98.27% of the visible Laravel hosts in the OX sample were still unpatched, and the framework has no tool that changes the server's PHP.

      Source ↗
    • ChatGPTplace 5

      There may be no CMS dashboard at all to warn the owner that the actual runtime remains vulnerable.

    • Grokplace 5

      Application code can be current while the underlying PHP worker remains on a vulnerable branch until an operator restarts with a new binary

      Source ↗
    • Nemotronplace 6

      Laravel 11.x requires PHP 8.2+; many 10.x apps on PHP 8.1; no auto-updater for PHP

      Source ↗
    4 AIs put it here
    Source ↗
  6. 6

    OpenCart and other legacy PHP shops

    Old shops on PHP 5.6–8.1 get no official PHP release. Their fix is a community patch collection, not one click.

    Included it: Claude, Nemotron, Gemini. Did not include: ChatGPT, Grok, Kimi, Wenxin.

    In their lists: Claude: 2 · Nemotron: 9 · Gemini: 5

    What each AI noted 3
    • Claudeplace 2

      The fix for these sites is a community-maintained patch collection for PHP 5.6 to 8.1, not a one-click update.

      Source ↗
    • Nemotronplace 9

      OpenCart 4.x needs PHP 8.1+; 3.x dominant on PHP 7.4/8.0; extension ecosystem lags

      Source ↗
    • Geminiplace 5

      Widely installed across unmanaged budget shared hosting where merchant store owners rarely know their PHP interpreter is five years obsolete.

      Source ↗
    3 AIs put it here
    Source ↗
  7. 7

    cPanel, Plesk and phpMyAdmin

    0 of 587 affected cPanel hosts were patched at 24 hours. Sources disagree on fix coverage: back to PHP 5.2 (CloudLinux) or nothing below 7.3.

    Included it: Claude, ChatGPT, Kimi. Did not include: Grok, Nemotron, Gemini, Wenxin.

    In their lists: Claude: 9 · ChatGPT: see list · Kimi: 10

    What each AI noted 3
    • Claudeplace 9

      Plesk shipped fixed PHP 8.2 to 8.5 builds, but the site owner still has to apply them.

      Source ↗
    • ChatGPT

      Named differently in its own list: open the full list.

      see list
    • Kimiplace 10

      cPanel shipped fixes for PHP 7.4 to 8.1 — and nothing at all for PHP 7.3 and older, leaving a vast tail of control-panel installs frozen.

      Source ↗
    3 AIs put it here
    Source ↗
  8. 8

    WooCommerce

    About 1 in 5 WordPress sites is a WooCommerce store. Its docs now require PHP 8.3+, yet stores are hit 'even when their own code is clean.'

    Included it: Grok, Kimi. Did not include: Claude, ChatGPT, Nemotron, Gemini, Wenxin.

    In their lists: Grok: 10 · Kimi: 5

    What each AI noted 2
    • Grokplace 10

      The store plugin can be current while the PHP version reported in Site Health remains vulnerable until the host acts

      Source ↗
    • Kimiplace 5

      One in five WordPress sites is a store, and WooCommerce's own docs now demand PHP 8.3+ — while most stores sit on whatever PHP their WordPress host happened to pick.

      Source ↗
    2 AIs put it here
    Source ↗
  9. 9

    MediaWiki

    The software behind Wikipedia: MediaWiki 1.46.2 was on the exploit demo list, and Wikimedia disabled its own Phabricator hours before the patch.

    Included it: Grok, Kimi. Did not include: Claude, ChatGPT, Nemotron, Gemini, Wenxin.

    In their lists: Grok: 7 · Kimi: 7

    What each AI noted 2
    • Grokplace 7

      High-profile PHP deployments that still require the infrastructure team, not the wiki software, to apply the engine patch

      Source ↗
    • Kimiplace 7

      The software behind Wikipedia shares the same engine — Wikimedia disabled its own Phabricator hours before the patch landed.

      Source ↗
    2 AIs put it here
    Source ↗
  10. 10

    Nextcloud (self-hosted)

    Its one-click updater moves the app, not PHP. Current Nextcloud 35.0.1 was exploited in the demo. Only one AI listed it, and it has no exposure count.

    Included it: Kimi. Did not include: Claude, ChatGPT, Grok, Nemotron, Gemini, Wenxin.

    In their lists: Kimi: 8

    What each AI noted 1
    • Kimiplace 8

      Nextcloud's polished one-click updater moves the app — but it cannot touch the PHP underneath, and Nextcloud 35.0.1 was on the exploit demo list.

      Source ↗
    1 AIs put it here
    Source ↗

More about the top three ↓

02More about the top three

The ranking is above. Here is more about the three places at the top: what they are, why they are here, and what is worth knowing.

The three are measured on different sample sizes, so the share still unpatched is close for all, while the number of sites at risk differs a lot.

1WordPress

No. 1 — WordPress. On the lists of 7 of 7 AIs; median place there: 1. It has the biggest pool of exposed sites, and updating WordPress itself does not fix the PHP engine underneath it.

Did you know

  • WordPress versions are named after jazz artists. Version 1.0, released on January 3, 2004, was called "Miles". The very first release, 0.7, came out on May 27, 2003.

    Source ↗
What it is
The most used website platform, which runs on PHP.
Its edge
It has far more affected hosts than Drupal or Joomla.
Who should know
Useful for anyone with a WordPress site, since its own update will not fix this.
  • Hosts patched after 24 hours299 of 33,075 patched

Wikipedia · Wikidata

Why it is here

  • In one 24-hour scan, 33,075 of 41,882 WordPress sites showing their PHP version ran an affected release. Only 299 had a patched one. That is the biggest pool of the three platforms.

    Source ↗

  • WordPress's own January 2026 PHP numbers: 22.20% of monitored sites ran PHP 7.4, 15.39% ran 8.1 and 5.69% ran 8.0. Together that is about 43%, before counting any older versions.

    Source ↗
History

  • In 2003, Matt Mullenweg started WordPress as a fork of b2, a blogging tool. Its creator had stopped maintaining it, so Mullenweg took the free code and built a new version.

    Source ↗
Keep in mind

  • WordPress still runs on PHP 7.4+, but the official requirements page says that version is end-of-life and may expose your site to security vulnerabilities. It recommends PHP 8.3 or greater.

    Source ↗

  • A host-forced PHP change can break old themes or plugins. One forum user's admin area stopped working after a PHP update, and the host later switched PHP back to an older version.

    Source ↗
What people say

  • While trying to fix a relatively minor Google Map API problem, I have gone down a rabbit hole that has taken my site offline. — justinfarquhar

    Source ↗
Where to go further

  • Open the requirements page and find the PHP line first. It lists the PHP version WordPress recommends your host run. Then check which PHP version your own site runs in your hosting panel.

    Source ↗

Video: WordPress.org VS WordPress.com: The Confusing Differences Explained! · Darrel Wilson

Compare the top three ↓

2Drupal

No. 2 — Drupal. On the lists of 7 of 7 AIs; median place there: 3. Nearly half of Drupal sites already run an end-of-life core, and almost none of the affected hosts were patched after a day.

Did you know

  • Drupal's name comes from a typo. Dries Buytaert wanted "dorp.org" (Dutch for "village") but typed "drop". The name Drupal comes from the Dutch word "druppel", meaning drop.

    Source ↗
What it is
A website platform often used for bigger, custom-built sites.
Its edge
Many sites sit on a core that no longer gets security fixes.
Who should know
Useful for Drupal owners still on version 7, who need to move on.
  • Hosts patched after 24 hours31 of 3,919 patched

Wikipedia · Wikidata

Why it is here

  • Of 5,078 Drupal hosts that showed their PHP version, 3,919 were affected after 24 hours. Only 31 had patched, so 99.22% of the affected ones were still open.

    Source ↗

  • W3Techs shows Drupal 7 on 29.0% of Drupal sites on 22 October 2026. That is more than Drupal 10 at 28.7%, and Drupal 7 no longer gets security fixes.

    Source ↗
History

  • Around 2000, Dries Buytaert and friends in a university dorm shared one ADSL modem among eight students. They built a small website to talk, and it grew into Drupal.

    Source ↗
Keep in mind

  • Tag1 says core's migration tool does not move Views, the saved lists and layouts that show content. Those pieces need a separate module or must be rebuilt by hand.

    Source ↗
Compare the top three ↓

3Joomla

No. 3 — Joomla. On the lists of 7 of 7 AIs; median place there: 3. Almost no affected Joomla hosts were patched, and even the current Joomla version was exploited in a demo.

Did you know

  • Joomla is a spelling of the Swahili word "Jumla", which means "all together" or "as a whole". The founding team chose it, and branding and marketing professionals reviewed the name before it was adopted.

    Source ↗
What it is
A website platform that grew out of the older Mambo.
Its edge
It had the highest share of affected hosts still open after a day.
Who should know
Useful for Joomla owners, because updating Joomla alone does not close the hole.
  • Hosts patched after 24 hours4 of 646 patched

Wikidata

Why it is here

  • Of 1,099 Joomla hosts that showed their PHP version, 646 were affected and only 4 had patched after 24 hours. At 99.38% still affected, Joomla scored worse than WordPress (99.1%) and Drupal (99.22%).

    Source ↗

  • Wiz researchers showed unauthenticated remote code execution on the latest Joomla container image, rated CVSS 9.2. The bug is in PHP itself, so updating Joomla alone does not close it.

    Source ↗
History

  • In 2005, Mambo's core developers quit after a fight over control. Miro, which owned the Mambo name, set up a foundation that developers said gave it too much power. They then started Joomla.

    Source ↗
Keep in mind

  • Joomla 3 is fully out of support. The official manual says support ended on 17 August 2023 and Extended LTS ended on 17 February 2025. Sites still on it get no fixes.

    Source ↗
What people say

  • K2 extension do not work inside J4, and will not work (!) becuase of K2 developers. — Paul Frankowski

    Source ↗
Where to go further

  • Read the PHP line first. Joomla 6 needs PHP 8.3.0 at least, and 8.4 is recommended. Compare that with the PHP version your host gives your site.

    Source ↗
Compare the top three ↓

The top three side by side

WordPressDrupalJoomla
In the AIs' lists7 / 77 / 77 / 7
Hosts patched after 24 hours299 of 33,075 patched31 of 3,919 patched4 of 646 patched
Put first byChatGPT, Grok, Nemotron, Gemini, Kimi, Wenxin——

Places with the same number of AIs are ordered by their average place in the AIs' own lists.

More ratings

03Worth knowing

What the AIs noticed while building the list.

24 hours after the fix, 99.3% of measurable PHP instances in a Shodan sample were still unpatched; patched hosts rose only from 245 to 14,151 of about 2M.

Noticed by:
Included it: Claude, Grok. Did not include: ChatGPT, Nemotron, Gemini, Kimi, Wenxin.
Source ↗

Two separate counts agree that about 7 in 10 exposed PHP hosts run a branch the PHP project no longer supports: Flare 72.7%, Qualys 71%.

Noticed by:
Included it: Claude. Did not include: ChatGPT, Grok, Nemotron, Gemini, Kimi, Wenxin.
Source ↗

A green 'up to date' dashboard proves nothing here: the flaw sits below WordPress, themes and plugins, so only a PHP update fixes it.

Noticed by:
Included it: Claude, ChatGPT, Gemini, Kimi. Did not include: Grok, Nemotron, Wenxin.
Source ↗

Version numbers mislead both ways: CloudLinux backports can leave a fixed host showing PHP 8.5.11, while distribution packages may keep an old version string.

Noticed by:
Included it: Claude, Kimi. Did not include: ChatGPT, Grok, Nemotron, Gemini, Wenxin.
Source ↗

Exposure estimates vary widely with the method: from about 1.3M hosts to 2.6M (VulnCheck), 6.29M (Censys) and 22.6M 'potentially vulnerable' instances (Palo Alto Networks).

Noticed by:
Included it: Claude, Grok, Kimi. Did not include: ChatGPT, Nemotron, Gemini, Wenxin.
Source ↗

04Questions people ask

How to update PHP

Move to a fixed release: 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart every service that loads PHP. PHP 8.1 and older get no official fix, so they need a vendor backport or an upgrade.

Source ↗
How to update PHP on my website

On shared or managed hosting, choose a fixed PHP version in your host's control panel or ask support. Updating WordPress, Drupal, Joomla or Magento does not change the PHP engine.

Source ↗
How to update PHP in Windows

Download a fixed Windows build (8.5.12, 8.4.27, 8.3.36 or 8.2.35) from windows.php.net, replace the old PHP folder but keep php.ini, then restart IIS, Apache or PHP-CGI.

Source ↗
How to update PHP version

Check your version with php -v and upgrade to 8.2.35 or newer. Since PHP 8.2 itself reaches end of life on 31 Dec 2026, target 8.3, 8.4 or 8.5 and test on staging first.

Source ↗

05How we counted

In plain words, no formulas.

1The question

Top 10 Website Platforms Where an Up-to-Date Site Can Still Run on a Vulnerable PHP

2Why this topic

It puts usage surveys next to internet scans and adds who actually controls the fix, so a site owner sees the gap between "my site is updated" and "my server is safe". No single table shows that gap.

3Where it applies

Global; WordPress, Drupal, Joomla, Magento and other website software that runs on PHP

4What we looked at

  • Share of each platform's installs that run a PHP version past end of life
  • Share of those installs that scanners can reach from the internet
  • Share that run PHP in the vulnerable way, such as CGI mode
  • Whether the platform's own updater can change the PHP engine, or only the platform itself
  • How fast the fix reaches a typical site: one click, the hosting company, or a manual server upgrade
  • WordPress.org Statistics — Share of active WordPress installs by the PHP version they report. Readings of the live chart differ: 32.4% to 36.4% on PHP 8.1 or older
  • OX Security (Shodan sample, 24 hours after the fix) — Hosts found, affected and patched for each technology. It is a sample, not the whole internet
  • W3Techs / TheDropTimes — Share of PHP versions across the web, and Drupal sites on end-of-life major versions

5Who ranked

The leading AIs, each building its own list of ten independently and naming a source for every place: Claude, ChatGPT, Grok, Nemotron, Gemini, Kimi, Wenxin.

6How the places were set

The same entry written differently by different AIs was counted as one. The more AIs put an entry on their list, and the higher they put it, the higher its place. "AI agreement" shows how many of the AIs had it on their own list. Sources are only those the AIs found themselves; nothing was added by hand.

06Each AI's own list

🇺🇸 Claude10 places · 4 notes

The same question, answered by Claude alone. The final list above combines all the AIs.

  1. 1
    Magento / Adobe Commerce (self-hosted)

    In the OX sample, 48 visible Magento hosts were affected and none had been patched after 24 hours. A store's own updates never touch PHP.

    Source ↗
  2. 2
    OpenCart and other legacy PHP shops

    The fix for these sites is a community-maintained patch collection for PHP 5.6 to 8.1, not a one-click update.

    Source ↗
  3. 3
    Drupal (self-hosted)

    Wiz showed remote code execution against the latest Drupal image, so an up-to-date core gave no protection.

    Source ↗
  4. 4
    Joomla (self-hosted)

    Only 4 of the 1,099 Joomla hosts in the OX sample showed a patched PHP after a day.

    Source ↗
  5. 5
    WordPress on shared hosting or a self-run VPS

    About 1 in 3 WordPress installs report PHP 8.1 or older, and WordPress.org said no WordPress update is planned: the PHP update is the fix.

    Source ↗
  6. 6
    Laravel and custom PHP apps on rented servers

    98.27% of the visible Laravel hosts in the OX sample were still unpatched, and the framework has no tool that changes the server's PHP.

    Source ↗
  7. 7
    Docker-based WordPress / Drupal / Joomla images

    A rebuild fixes it, but the official php image gets no fix for 8.1 or older.

    Source ↗
  8. 8
    Sites on cPanel / CloudLinux shared hosting

    The control panel's PHP packages were fixed back to PHP 5.2, but a patched site may still show an old version number.

    Source ↗
  9. 9
    Plesk-managed sites (VPS and hosts)

    Plesk shipped fixed PHP 8.2 to 8.5 builds, but the site owner still has to apply them.

    Source ↗
  10. 10
    Managed WordPress hosting (Pantheon, Pressable, Kinsta, WP Engine)

    Pantheon and Pressable were already fully patched on 22 October. WP Engine and Flywheel put CDN protection in front while their updates rolled out.

    Source ↗

What Claude noticed

The OX Security Shodan sample found 99.3% of measurable PHP instances still unpatched 24 hours after the fix. The patched count rose from 245 to 14,151 of about 2M.

Source ↗

Two separate measurements agree that roughly 7 in 10 exposed PHP runs a branch the PHP project no longer supports: Flare 72.7% of service records, Qualys 71% of installations.

Source ↗

An updated WordPress dashboard gives false comfort. Codeable says WordPress.org confirmed no WordPress update is required or planned, because the flaw sits below WordPress, themes and plugins.

Source ↗

A banner can mislead in both directions. CloudLinux backports can leave a fixed host showing PHP 8.5.11, while Ubuntu or Debian packages may keep the old version string.

Source ↗
🇺🇸 ChatGPT10 places · 3 notes

The same question, answered by ChatGPT alone. The final list above combines all the AIs.

  1. 1
    WordPress websites — PHP security update, 2026

    The world's most widely used CMS cannot patch the PHP engine through the ordinary WordPress core-update button.

    Source ↗
  2. 2
    Joomla websites — PHP security update, 2026

    An up-to-date Joomla dashboard can coexist with an outdated PHP engine underneath it.

  3. 3
    Drupal websites — PHP security update, 2026

    Drupal documents a hard boundary: no supported Drupal release supports PHP 7, yet upgrading Drupal still does not patch PHP itself.

    Source ↗
  4. 4
    Adobe Commerce and Magento Open Source — PHP security update, 2026

    A runtime fix can become a coordinated commerce upgrade when the PHP version and the store's supported dependency stack must move together.

    Source ↗
  5. 5
    Custom PHP websites — PHP security update, 2026

    There may be no CMS dashboard at all to warn the owner that the actual runtime remains vulnerable.

  6. 6
    Legacy PHP applications — PHP security update, 2026

    PHP 5 and PHP 7 together accounted for 34.7% of detected PHP websites in the October 19 W3Techs snapshot, although that is not the same as the share vulnerable to these CVEs.

    Source ↗
  7. 7
    PHP applications on shared hosting — PHP security update, 2026

    One host-level runtime may be the security bottleneck for many separately maintained customer websites.

    Source ↗
  8. 8
    PHP websites on managed cloud hosting — PHP security update, 2026

    Managed hosting can shorten the path to a patch, but only if the provider updates the actual runtime and verifies the deployed service.

    Source ↗
  9. 9
    PHP applications bundled in appliances and third-party products — PHP security update, 2026

    A website owner may not even know that a product they purchased contains the PHP runtime that needs updating.

    Source ↗
  10. 10
    PHP sites with automated server deployment — PHP security update, 2026

    Automation can turn an emergency patch into a routine deployment, but a pipeline that only updates application files leaves the runtime untouched.

    Source ↗

What ChatGPT noticed

PHP accounted for 69.7% of websites with an identified server-side language in the October 13 W3Techs comparison. That scale makes a runtime flaw an ecosystem-wide issue rather than a problem belonging to one CMS.

Source ↗

On October 19, 2026, 27.0% of detected PHP websites used PHP 7 and 7.7% used PHP 5. This is a strong warning about legacy maintenance, but neither percentage directly measures exposure to the two newly disclosed CVEs.

Source ↗

A CMS update and a PHP runtime update are separate operations. WordPress explicitly places PHP version selection at the server or hosting level, which explains why an apparently current dashboard can still conceal an unpatched engine.

Source ↗
🇺🇸 Grok10 places · 3 notes

The same question, answered by Grok alone. The final list above combines all the AIs.

  1. 1
    WordPress

    Even a fully patched WordPress site stays exposed until the host upgrades the PHP engine underneath it

    Source ↗
  2. 2
    Drupal

    About half the detected Drupal sites already run end-of-life majors, and PHP underneath is equally outside the platform’s updater

  3. 3
    Joomla

    Smaller footprint than WordPress yet the same host-controlled PHP barrier for any site that wants the October 2026 fixes

    Source ↗
  4. 4
    Magento / Adobe Commerce

    E-commerce installs that stay current on the platform can still sit on unpatched PHP until the server or host moves the runtime

    Source ↗
  5. 5
    Laravel (and similar PHP frameworks)

    Application code can be current while the underlying PHP worker remains on a vulnerable branch until an operator restarts with a new binary

    Source ↗
  6. 6
    PrestaShop

    Open-source shop software whose security releases do not touch the PHP engine that actually serves the pages

    Source ↗
  7. 7
    MediaWiki / Wikipedia-family sites

    High-profile PHP deployments that still require the infrastructure team, not the wiki software, to apply the engine patch

    Source ↗
  8. 8
    phpBB and other PHP forums

    Forum software updates leave the interpreter untouched; shared hosts decide when the vulnerable PHP disappears

    Source ↗
  9. 9
    Custom PHP applications on shared hosting

    No platform updater at all; the site owner’s only lever is the host’s PHP selector or a support ticket

    Source ↗
  10. 10
    WooCommerce stores on WordPress

    The store plugin can be current while the PHP version reported in Site Health remains vulnerable until the host acts

    Source ↗

What Grok noticed

PHP powers 69.3% of websites whose server-side language is known, yet the only complete fix for the October 2026 RCEs is a runtime upgrade that almost no CMS can perform itself.

Source ↗

WordPress.org data still shows 16.24% of active installs on PHP 7.4 and 10.68% on PHP 8.1, both outside the branches that received official fixed releases.

Source ↗

Hosts such as GoDaddy reported patching their managed PHP fleets within hours, but any site pinned to an older branch or on a self-managed server stayed exposed until a manual change.

Source ↗
🇺🇸 Nemotron10 places · 1 notes

The same question, answered by Nemotron alone. The final list above combines all the AIs.

  1. 1
    WordPress

    ~60% of WordPress sites run on EOL PHP per WP.org stats, but 1-click PHP switch exists on most managed hosts

  2. 2
    Drupal

    Drupal 10+ requires PHP 8.1+, but Drupal 7 sites (still ~15% of installs) stuck on PHP 7.4 EOL

    Source ↗
  3. 3
    Joomla

    Joomla 5.x needs PHP 8.2+; 4.x on 8.1; many 3.x sites still on PHP 7.4 with no core upgrade path

    Source ↗
  4. 4
    Magento / Adobe Commerce

    Magento 2.4.7+ requires PHP 8.2+; older 2.4.x on PHP 8.1 EOL soon; Cloud auto-updates PHP

    Source ↗
  5. 5
    TYPO3

    TYPO3 v12 LTS needs PHP 8.1+; v11 EOL 2024; many v10/v11 sites on PHP 7.4/8.0

  6. 6
    Laravel (framework, not CMS)

    Laravel 11.x requires PHP 8.2+; many 10.x apps on PHP 8.1; no auto-updater for PHP

    Source ↗
  7. 7
    Symfony (framework)

    Symfony 7.x needs PHP 8.2+; 6.4 LTS on 8.1; many 5.4/6.x apps on older PHP

    Source ↗
  8. 8
    PrestaShop

    PrestaShop 8.1+ needs PHP 8.1; 1.7 still widespread on PHP 7.4; no core PHP switcher

    Source ↗
  9. 9
    OpenCart

    OpenCart 4.x needs PHP 8.1+; 3.x dominant on PHP 7.4/8.0; extension ecosystem lags

    Source ↗
  10. 10
    Moodle

    Moodle 4.5 needs PHP 8.2; 4.1 LTS on 8.0; many 3.11/4.0 sites on PHP 7.4

    Source ↗

What Nemotron noticed

CGI/FPM mode matters: PHP-FPM with opcache hides version in headers; CGI exposes it. Scanners miss FPM pools behind proxies.

Source ↗
🇺🇸 Gemini10 places · 1 notes

The same question, answered by Gemini alone. The final list above combines all the AIs.

  1. 1
    WordPress

    Over 40 million updated sites show green checkmarks in wp-admin while quietly running on end-of-life PHP 7.4 or 8.0 engines underneath.

    Source ↗
  2. 2
    Joomla

    Nearly half of production deployments run legacy PHP because extensions break immediately upon stepping onto PHP 8.2 or 8.3.

  3. 3
    Drupal

    A severe divide exists where Drupal 7 enterprise holdouts preserve PHP 7.4 runtimes despite Drupal 10 demanding modern PHP 8.2+.

    Source ↗
  4. 4
    Magento (Adobe Commerce)

    Strict compiled dependency constraints mean upgrading the underlying PHP engine requires rebuilds, leaving e-commerce stores frozen on retired runtimes.

    Source ↗
  5. 5
    OpenCart

    Widely installed across unmanaged budget shared hosting where merchant store owners rarely know their PHP interpreter is five years obsolete.

    Source ↗
  6. 6
    PrestaShop

    Payment module incompatibilities keep 38% of active merchants chained to legacy PHP 7.4 despite critical vulnerability warnings.

    Source ↗
  7. 7
    TYPO3

    Long Term Support enterprise cycles guarantee CMS patches for up to 6 years, often outliving the standard support life of the PHP runtime underneath.

    Source ↗
  8. 8
    Moodle

    Academic institutions run on rigid academic calendar cycles, freezing institutional server stacks on retired PHP versions between academic years.

    Source ↗
  9. 9
    phpBB

    Thousands of legacy community forums run on forgotten hobbyist servers where the board application updates while Apache FastCGI remains unchanged.

    Source ↗
  10. 10
    vBulletin

    Commercial license holders often retain legacy installations on vintage LAMP stacks to avoid costly commercial license renewals.

What Gemini noticed

Over 35% of all PHP-powered websites worldwide continue running on PHP 7.4 or older versions that ceased receiving official community security updates years ago.

Source ↗
🇨🇳 Kimi10 places · 4 notes

The same question, answered by Kimi alone. The final list above combines all the AIs.

  1. 1
    WordPress (2026)

    Two of every five websites on Earth run it — and one in three still reports an end-of-life PHP, while the fully-updated WordPress 7.1.2 was on the researcher's own exploit demo list.

    Source ↗
  2. 2
    Joomla (2026)

    82% of Joomla sites still run version 3 — software that works fine on PHP from 2012 — and the Joomla project's own website went offline over this bug.

    Source ↗
  3. 3
    Magento / Adobe Commerce (2026)

    Magento 1 stores have had no official security support since June 2020 — for them this emergency fix simply does not exist, only a server upgrade does.

    Source ↗
  4. 4
    Drupal (2026)

    Nearly half of all Drupal sites still run an end-of-life core — 29% are on Drupal 7 alone, dead since January 2025 — so their PHP is usually even older.

  5. 5
    WooCommerce (2026)

    One in five WordPress sites is a store, and WooCommerce's own docs now demand PHP 8.3+ — while most stores sit on whatever PHP their WordPress host happened to pick.

    Source ↗
  6. 6
    Shopware (2026)

    Sansec's day-one warning lumped Shopware in with Magento: DACH-region stores exposed 'even when their own code is clean.'

    Source ↗
  7. 7
    MediaWiki (2026)

    The software behind Wikipedia shares the same engine — Wikimedia disabled its own Phabricator hours before the patch landed.

    Source ↗
  8. 8
    Nextcloud (self-hosted, 2026)

    Nextcloud's polished one-click updater moves the app — but it cannot touch the PHP underneath, and Nextcloud 35.0.1 was on the exploit demo list.

    Source ↗
  9. 9
    WHMCS (2026)

    The billing panel hosting companies use to sell you 'fully managed' hosting was itself on the researcher's affected list.

    Source ↗
  10. 10
    phpMyAdmin / cPanel & Plesk panels (2026)

    cPanel shipped fixes for PHP 7.4 to 8.1 — and nothing at all for PHP 7.3 and older, leaving a vast tail of control-panel installs frozen.

    Source ↗

What Kimi noticed

An updated admin dashboard can lie: WordPress.org confirmed no WordPress update is required or planned for these flaws — the fix lives only in the PHP engine, so a green 'everything is up to date' badge is a false sense of safety on any platform.

Source ↗

One in three WordPress sites runs an end-of-life PHP (7.4 + 8.0 + 8.1 = 32.4% in Oct 2026), and 7.7% of all PHP sites still run PHP 5 — version 5.6 alone is 55% of that, on servers that have missed a decade of fixes.

Source ↗

The fix path splits by business model, not by country: Hostinger and OVHcloud pushed the patch to every managed customer automatically (Hostinger finished 22 Oct, 06:44 UTC), while GoDaddy told customers to check and update themselves and the volunteer-run Remi repository had no packages on day one.

Source ↗

mod_php is the worst-case configuration: PHP validated full RCE there with default limits, before any application code runs — echoing CVE-2024-4577, the Windows CGI bug that was mass-exploited within days while EOL branches never got a patch.

Source ↗
🇨🇳 Wenxin10 places · 1 notes

The same question, answered by Wenxin alone. The final list above combines all the AIs.

  1. 1
    WordPress 6.x (2026)

    Nearly 4 in 10 sites run on it, yet a single dashboard click can switch the PHP engine if the host allows it — but 18 % of installs still report PHP 7.x or below

  2. 2
    Drupal 10/11 (2026)

    Updater can change the platform but cannot touch the PHP engine — 22 % of Drupal sites sit on EOL PHP because the host never upgraded

    Source ↗
  3. 3
    Joomla 4/5 (2026)

    One-click updater for Joomla itself, zero control over PHP — one in five Joomla installs still ships PHP 7.4

    Source ↗
  4. 4
    Magento (Adobe Commerce) 2.4 (2026)

    Enterprise-grade platform but the updater only patches Magento code; PHP upgrade means calling the hosting company — 30 % of stores still on PHP 7.4

    Source ↗
  5. 5
    Wix / Squarespace (SaaS, 2026)

    These platforms run their own PHP stacks — the user never touches the engine, so the fix lands the day PHP ships, but their lock-in hides the risk

  6. 6
    Shopify (SaaS, 2026)

    Like Wix: fully managed, PHP risk absorbed by the vendor — yet their massive scale means one bad patch ripple hits hundreds of thousands of stores at once

  7. 7
    PrestaShop (2026)

    Open-source e-commerce with a one-click updater for the app but not PHP; roughly 27 % of shops still on PHP 7.4 or older

    Source ↗
  8. 8
    Typo3 CMS (2026)

    German-engineered CMS that lets admins change PHP in the install tool — but only 14 % of installers actually do, leaving 300 k+ exposed

  9. 9
    Craft CMS (2026)

    Boutique CMS with a tidy updater; the catch is that most small-business sites run it on shared hosts that never upgrade PHP — 19 % on EOL

  10. 10
    Concrete CMS (2026)

    The platform's own updater patches the CMS, not PHP — the smallest footprint here means the fewest total victims but the slowest patch cadence

What Wenxin noticed

The 'one-click updater' myth: WordPress, Drupal, Joomla and Magento all let you update the CMS in one click, but none of them can upgrade the PHP engine running underneath — that step requires the host.

Source ↗