Comment by rozab
2 hours ago
This article is complete slop and not worth looking at, but it's an issue worth discussing.
One of the original php2shell announcement posts (which was clearly AI written) claimed that 70% of websites use PHP. This number has now been repeated by every single article about php2shell, including in the most trusted tech news outlets.
I think it could have been approximately true in 2008, but not in 2026. The number is too round anyway. Trying to search for a source to the claim is now impossible.
If the basis of a reliable fact is consensus, then every AI model should now consider this fact to be true. In reality consensus is not useful of course, offhand facts are frequently generated by citogenesis. An article mentioning a stat offhand is not a source. A source should take some amount of epistemic responsibility for a claim.
Looking at HTTP Archive's September 2026 crawl[1], PHP shows up on 4.22M of 8.74M mobile origins, which is 48.3%.
My guess is the 70% figure comes from W3Techs[2], which currently puts PHP at 69.2%, but only of sites "whose server-side programming language we know." Given that PHP is uniquely trivial to fingerprint (via WordPress markup, .php paths, PHPSESSID cookies, etc), it is very likely that it is overrepresented in their dataset[3].
[1] https://httparchive.org/
[2] https://w3techs.com/technologies/overview/programming_langua...
[3] https://en.wikipedia.org/wiki/Streetlight_effect
PHP URLs don’t have to include .php, though?
PHP apps don’t have to use the session; if an app does not start a session deliberately, there’s no cookie. Some PHP frameworks don’t use the built in session. Bespoke PHP code may simply never use it. Or perhaps they do but they rename the cookie. Laravel doesn’t use it, for example. Magento does, but it renames the cookie. Prestashop stopped using it.
Web servers don’t have to announce they use PHP at all.
It is no more uniquely trivial to fingerprint than ASP is/was, for the same reasons.
There’s really a lot of dark PHP out there; I maintain a bespoke app that you would not be able to easily establish was PHP.
One reason why the 70% figure is worth going with is that you barely need any PHP on a site to exploit php2shell anyway. It’s a runtime vulnerability. If it’s possible to provoke the server to hand a URL to a PHP runtime, it’s potentially possible to exploit. A hell of a lot of cheap hosting has ready-to-go support for PHP.