# Fact: PHP is used by almost 70% of websites whose server-side language is known

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

PHP is used by almost 70% of websites whose server-side language is known Who says it, its status (reported), its sources, and its timeline from publication to this site.

Fact · scale · reported

# PHP is used by almost 70% of websites whose server-side language is known

**Who says it:** Cloudflare; OpenAI ('an estimated 70%'); Wiz body text · **Sources:** [Cloudflare](../../sources/cloudflare-blog-php2shell-waf/index.html) [OpenAI on X](../../sources/x-openai-php2shell/index.html) [Wiz](../../sources/wiz-blog-php2shell/index.html)

None of the three cites the survey it comes from. A share of websites using PHP is an upper bound on exposure, not a count of vulnerable systems.

## Fact-check

**A2** Reported●●○○○○ measures differently · Count · verdict: **holds**

Now carries the population, 'websites whose server-side language is known' (Finding-33 fixed), which is how W3Techs measures it; Cloudflare's page links the figure to W3Techs. Three outlets repeat one survey, so A2 until the survey itself is captured (board 033). Outlets disagree on the value, about 69-70% against about 75% (Finding-103).

| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| [cloudflare-blog-php2shell-waf](../../sources/cloudflare-blog-php2shell-waf/index.html) | carries | *PHP is used by almost 70% of websites.* | 302408765abf45e3 |
| [cloudflare-blog-php2shell-waf](../../sources/cloudflare-blog-php2shell-waf/index.html) | carries | *PHP is used by almost 70% of websites.* | a0d3c37cde7c1721 |
| [x-openai-php2shell](../../sources/x-openai-php2shell/index.html) | carries | *an open-source programming language used to run an estimated 70% of websites.* | 785b7cae55e3748b |
| [wiz-blog-php2shell](../../sources/wiz-blog-php2shell/index.html) | carries | *a popular general-purpose scripting language that powers 70% of all websites in the world.* | e3568b6f88c93f6b |
| [imperva-blog-php2shell](../../sources/imperva-blog-php2shell/index.html) | partial | *With PHP used by over 69% of websites whose server-side programming language is known* | 3da873bdb21219a6 |
| [tenable-php2shell-faq](../../sources/tenable-php2shell-faq/index.html) | partial | *According to W3Techs, PHP is used by 69.3% of websites whose server-side language is known.* | 10d98694b9c0243e |
| [rte-reuters-websites-go-dark](../../sources/rte-reuters-websites-go-dark/index.html) | partial | *PHP runs roughly 75% of websites whose programming language can be identified, according to web technology tracker W3Techs* | 99bb92662561bd29 |
| [abc-au-gov-sites-exposed](../../sources/abc-au-gov-sites-exposed/index.html) | partial | *PHP runs about 75 per cent of websites whose programming language can be identified, according to web technology tracker W3Techs.* | 84937c7c5b87e7c9 |

Open tickets: [Contradiction-1](https://php.oct.2026.newsroom.sgit.ai/factcheck/#Contradiction-1), [Contradiction-12](https://php.oct.2026.newsroom.sgit.ai/factcheck/#Contradiction-12), [Evidence-15](https://php.oct.2026.newsroom.sgit.ai/factcheck/#Evidence-15), [Finding-103](https://php.oct.2026.newsroom.sgit.ai/factcheck/#Finding-103), [Finding-32](https://php.oct.2026.newsroom.sgit.ai/factcheck/#Finding-32), [Finding-33](https://php.oct.2026.newsroom.sgit.ai/factcheck/#Finding-33).

Graded in Run-3, resting on captures up to 2026-10-22 11:23 UTC. The scale is on [the fact-check page](https://php.oct.2026.newsroom.sgit.ai/factcheck/#ladder).

## This fact over time
- 2026-10-21Cloudflare publishes [Cloudflare deploys protections against php2shell vulnerability](../../sources/cloudflare-blog-php2shell-waf/index.html)
- 2026-10-21Wiz publishes [PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet](../../sources/wiz-blog-php2shell/index.html)
- 2026-10-21 14:04 UTCOpenAI on X publishes [OpenAI on X: OpenAI models helped researchers ... discover critical security flaws in PHP](../../sources/x-openai-php2shell/index.html)
- 2026-10-22 08:10 UTCSaved into the evidence vault: Wiz, then 1 more capture
- 2026-10-22 08:12 UTCSaved into the evidence vault: Cloudflare, then 1 more capture
- 2026-10-22 08:16 UTCSaved into the evidence vault: OpenAI on X
- 2026-10-22Enters this site as reported in v0.1.0 (reconstructed from git)
- 2026-10-24Reworded or re-sourced in v0.12.1

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

## What it rests on

## Where this fact appears

In the briefings for:
AAlexCurious readerJJordanBoard member or executiveSSamSecurity leadRRowanJournalistBBlakeAnalyst or policy advisorRRobinCISOQQuinnCFORRileyCommunications team
And on [every claim](https://php.oct.2026.newsroom.sgit.ai/claims/#scale-70pc-websites).

## Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · reported
```
PHP is used by almost 70% of websites
Who says it: Cloudflare; OpenAI ('an estimated 70%'); Wiz body text
Status: reported
Topic: scale
Sources: cloudflare-blog-php2shell-waf, x-openai-php2shell, wiz-blog-php2shell
```
v2 · site v0.12.1 · 24 October 2026 · reportedPHP is used by almost 70% of websites whose server-side language is knownWho says it: Cloudflare; OpenAI ('an estimated 70%'); Wiz body text2 unchanged linesSources: cloudflare-blog-php2shell-waf, x-openai-php2shell, wiz-blog-php2shell


---
site v0.22.26 · data as of 2026-10-25T14:40Z · vault commit 94352a55fbaa · https://refs.php.oct.2026.newsroom.sgit.ai/facts/scale-70pc-websites/index.html