Bitsight Finds 35 Million Public PHP Observations as Patching Urgency Grows

Bitsight recorded more than 35 million public-facing PHP observations during a recent 30-day window, illustrating the scale of the patching and asset-discovery challenge facing internet-exposed web infrastructure.

The figures come from Bitsight Groma Explorer, which continuously scans services visible from the public internet. Nearly 9.7 million observations did not disclose a PHP version at all. Among systems that did reveal a version, the data included a long tail of older, unsupported or pre-patch releases.

Frequently observed versions included PHP 7.4.33, 8.3.35, 8.2.33, 8.1.34, 8.4.26 and 5.6.40, according to Bitsight. The company describes these as observations rather than a count of unique servers, and the telemetry does not establish that any system has been compromised.

The data matters because version opacity complicates emergency response. Security teams cannot reliably prioritize remediation if they do not know which public services run PHP, which branch each system uses or whether an internet-facing application was rebuilt after a security update. Older branches can also remain embedded in appliances, abandoned applications and hosting environments long after support ends.

For defenders, the practical task is broader than installing one update. Teams should inventory externally reachable PHP services, verify runtime versions from the host rather than relying only on banners, remove unnecessary exposure and confirm that supported branches are receiving security fixes. Web application firewall rules may reduce immediate risk, but they do not replace patching and validation.

Bitsight's dataset is best read as an exposure signal, not a breach count. Even so, tens of millions of observations and millions of unidentified versions suggest that many organizations still lack the visibility needed to respond quickly when critical PHP vulnerabilities emerge.