Update 28 October: decrease from 47% to 36%

MindYourPass re-examined the 188,577 applications that had previously shown indications of PHP usage. PHP usage could be confirmed in 58,622 applications, compared with 60,362 in the initial assessment.

The decrease in confirmed PHP applications is partly attributable to network errors during scanning, unreachable applications and systems where PHP was no longer externally detectable.

The proportion of applications running a visibly outdated or affected PHP version has fallen from 47% to 36%. This indicates progress in patching, although the findings do not establish exactly how many individual applications have actually been patched.

MindYourPass has also provided customers with organisation-specific reports, offering insight into the PHP status of the applications used within their organisation. This helps them identify applications that may require further investigation or follow-up with suppliers.

‍

Original research – 23 October 2026

[The original article and research methodology follow below.]
‍

On October 21, 2026, security updates were released for two critical PHP vulnerabilities that allow attackers to remotely execute malicious code under certain conditions without needing to log in. European cybersecurity authorities urged organizations to update vulnerable systems immediately.

Nearly half still on an outdated or affected version

MindYourPass analyzed 494,416 unique web applications that employees actually use for their daily work. Indications of PHP usage were found in 188,577 applications, and this could be confirmed with certainty for 60,362. Of this latter group,28,615 applications (47%) are running on an outdated, unsupported, or affected PHP version.

The study includes applications used within sectors such as local government, healthcare, education, financial services, and SMEs. This also includes applications for critical work processes, such as:

The research results were also published on October 23 byNRC. The findings align with international measurements showing that the process of updating PHP systems is still ongoing worldwide.

Security starts with knowing what is being used

The study exposes a broader challenge: many organizations lack a complete and up-to-date overview of the web applications their employees actually use. External applications, in particular, which fall outside the direct management of the IT department, easily remain out of sight. Without that insight, it is difficult to determine which applications may be vulnerable and where action is required.

Merijn de Jonge, CEO of MindYourPass:

"With vulnerabilities like these, organizations often first have to update their application inventory and then check with vendors to see which systems are at risk. That is time-consuming and costly. In the meantime, applications can be overlooked and necessary updates can be delayed.

By continuously measuring which applications are actually being used and what their visible security status is, we can identify risks faster and take targeted action. With this study, we want to make those insights available not only to our clients but also share them more broadly.

We expect to be able to provide our clients with more detailed information in the coming days so that they can take targeted action."

MindYourPass will continue to monitor the analyzed applications over the coming weeks and will periodically publish the progress of security updates. This will show how quickly the situation is improving and where potential risks remain.

Research Methodology

The study is based on anonymized web addresses of applications that employees of MindYourPass clients log into, which are inventoried continuously and in a privacy-friendly manner by the MindYourPass Agent. After excluding duplicate paths, IP hosts, and addresses accessible only via HTTP, 494,416 unique web addresses were analyzed for PHP usage and visible version information. The vulnerabilities were not actively tested. Because not all technical information is externally visible, the results do not prove that individual applications are actually vulnerable. The applications studied do not constitute a representative sample of all Dutch web applications.

‍