Research by the Eindhoven-based cybersecurity firm MindYourPass into nearly 500,000 web applications shows that 47% of applications demonstrably running on PHP are still using an outdated, unsupported, or vulnerable version. The findings indicate that remediation of the critical PHP vulnerabilities from October 21 is far from complete.

On October 21, 2026, security updates were released for two critical PHP vulnerabilities that allow attackers to remotely execute malicious code under certain conditions without needing to log in. European cybersecurity authorities urged organizations to update vulnerable systems immediately.

Nearly half still on an outdated or affected version

MindYourPass analyzed 494,416 unique web applications that employees actually use for their daily work. Indications of PHP usage were found in 188,577 applications, and this could be confirmed with certainty for 60,362. Of this latter group, 28,615 applications (47%) are running on an outdated, unsupported, or affected PHP version.

The study includes applications used within sectors such as local government, healthcare, education, financial services, and SMEs. This also includes applications for critical work processes, such as:

The research results were also published on October 23 by NRC . The findings align with international measurements showing that the process of updating PHP systems is still ongoing worldwide.

Security starts with knowing what is being used

The study exposes a broader challenge: many organizations lack a complete and up-to-date overview of the web applications their employees actually use. External applications, in particular, which fall outside the direct management of the IT department, easily remain out of sight. Without that insight, it is difficult to determine which applications may be vulnerable and where action is required.

Merijn de Jonge, CEO of MindYourPass:

"With vulnerabilities like these, organizations often first have to update their application inventory and then check with vendors to see which systems are at risk. That is time-consuming and costly. In the meantime, applications can be overlooked and necessary updates can be delayed.

By continuously measuring which applications are actually being used and what their visible security status is, we can identify risks faster and take targeted action. With this study, we want to make those insights available not only to our clients but also share them more broadly.

We expect to be able to provide our clients with more detailed information in the coming days so that they can take targeted action."

MindYourPass will continue to monitor the analyzed applications over the coming weeks and will periodically publish the progress of security updates. This will show how quickly the situation is improving and where potential risks remain.

Research Methodology

The study is based on anonymized web addresses of applications that employees of MindYourPass clients log into, which are inventoried continuously and in a privacy-friendly manner by the MindYourPass Agent. After excluding duplicate paths, IP hosts, and addresses accessible only via HTTP, 494,416 unique web addresses were analyzed for PHP usage and visible version information. The vulnerabilities were not actively tested. Because not all technical information is externally visible, the results do not prove that individual applications are actually vulnerable. The applications studied do not constitute a representative sample of all Dutch web applications.

‍