PHP2Shell: how fast do websites in Germany, Austria and Switzerland patch?
Why this study
Global counts of exposed servers already exist. Numbers for Germany, Austria and Switzerland do not, let alone for groups like municipalities or universities. We want to answer two questions: how many websites still run a PHP version without the fix shortly after the update? And how many of them are unchanged a week later?
Which websites we look at
- Municipalities and towns in Germany, Austria and Switzerland whose official website is listed in Wikidata.
- Universities and schools in the three countries, also from Wikidata.
- Well-known websites on .de, .at and .ch: all of the roughly 35,000 domains with these endings in the public Tranco list of the most visited websites. The first 10,000 are reported separately as "top websites".
How we measure
- One request per website. We only load the homepage, like any browser. We do not guess paths, submit forms or send attack or test code.
- What we read: the HTTP status, the
X-Powered-ByandServerheaders, the names of cookies that are set (not their contents), the generator tag and the page title. We check the page text only for a notice that the site is offline or under maintenance, and why. We do not store the page content. - Visible in your logs: our request identifies itself as
ShiftPress-PHP-Study/1.0with a link to this page. - Gentle: at most one request per second to the same server.
- Two waves: shortly after the update and one week later, with the same list. In between, we load the sites that still show a version without the fix once a day, to see how fast they get patched.
What the version number says, and what it doesn't
The version a server shows is a signal, not proof. Linux distributions such as Debian and Ubuntu often ship
security fixes without changing the number. We recognise those packages by their suffix (for example
8.1.2-1ubuntu2) and count them separately. That is why we speak of versions without an official
fix, never of "vulnerable websites". Sites that hide their version are counted, but left out of the share.
Every figure is published with its base.
Many hosts also patched older versions such as 8.0 or 8.1 without changing the number. An old number therefore does not mean a site is unprotected. We also break the results down by host and check them against each host's own status updates.
We also count sites that were taken offline as a precaution, as some organisations did on 21 October. We only count a site as such when its page says it is offline and names a security reason. A maintenance page without a reason is counted separately.
What happens to the data
- Aggregates only: per group, country, state or canton. We never name individual websites, not even on request.
- Public authorities: municipal websites showing a version without the fix are reported confidentially to the responsible agencies (CERT-Bund at the BSI, GovCERT Austria, the Swiss National Cyber Security Centre), not to the media.
- No sales use: we do not use the study data to contact site owners.
- Deletion: the raw data is deleted 30 days after the second wave.
Leave your domain out
Saw our request in your logs, or would rather not be part of the study? Write to [email protected] with the subject "PHP study: exclude domain" and the domain. We remove it from the collection right away and delete everything we hold on it. Questions about the method go to the same address.
Check your own site
You don't have to wait for the results. Our free PHP2Shell check shows in a few seconds whether your server reports a PHP version with the fix. It only looks at the address you enter, and its results are not saved or used in this study. How to find your PHP version and which version to move to is in How to check and update your PHP version. What PHP2Shell is and what to do now is in our article on the flaw.