After the PHP2Shell flaws (CVE-2026-109618, CVE-2026-109619) were disclosed on 21 October, the most common question is: how many websites in Azerbaijan does this affect? There is no official national statistic that answers it exactly. But the figures published by official bodies and international research paint a clear enough picture.
What the numbers say
- The National Cybersecurity Agency under the Ministry of Digital Development and Transport issued a warning about the flaws on 22 October. According to the Agency, about 70% of the most visited websites whose server technology can be identified run on PHP, and nearly 40% of those use WordPress.
- According to W3Techs data from 25 October, 69.2% of websites whose server-side language is known use PHP, and 34.6% of PHP sites still run PHP 7 or older.
- The .az domain registry (Whois.az) lists 52,412 registered .az domains as of 25 October.
- On 23 October Censys counted more than 4.18 million servers worldwide running PHP.
Applying these shares to the .az zone gives a rough estimate of around 36,000 domains that may be PHP-based, more than 12,000 of them on unsupported versions. This is an estimate, not an exact count: not every domain has an active website, and part of Azerbaijan's sites live on .com and other zones. But the scale is clear: we are talking about thousands of websites.
What happens to sites that aren't updated
PHP2Shell lets an attacker run code on the server without a password. On an unpatched site, an attacker can:
- change the site's content and plant hidden spam or phishing links;
- get into the database and steal customer data and passwords;
- use the server for further attacks, spam or cryptocurrency mining;
- encrypt the files and demand a ransom.
After that, Google may flag the site as dangerous, search rankings can drop and the hosting provider may shut the server down. A leak of personal data means both reputational damage and legal liability.
The highest-risk group is sites on old versions such as PHP 7, 5 or 8.0–8.1. The PHP project does not ship new releases for them, so the only reliable fix is moving to a supported version.
Support from Coresoft
Coresoft checks your site's PHP version, moves it safely to a supported version and makes sure the code keeps working on it. To use this service, contact us.
Sources: Report.az (National Cybersecurity Agency warning), W3Techs, Whois.az, Censys.
