19% of visible PHP hosts patched, deadline October 29

Three vulnerability stories ran through today's record, and what they have in common is that each one is stuck at a different point in the same sequence: a flaw is found, a fix is published, a fix is installed. Only one of the three has reached the end of it.

The fix exists and almost nobody has it

PHP2Shell is the one with a number attached. About 412,000 publicly reachable PHP hosts, roughly 19% of those visible worldwide, had been patched by midday on October 26, according to BleepingComputer, days after exploitation moved from probes to working shells, with 35 shells launched from two IP addresses against honeypots. The fix is not the hard part here and has not been for a while. The installation is.

CISA added the two flaws, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog and set federal agencies a remediation deadline of October 29. That is the only dated obligation anywhere in today's three stories, and it binds federal agencies, not the operators of the hosts sitting outside that 19%.

There is nothing to install

Tailscale has published no CVE, no security bulletin and no fixed version for the 11 SSH flaws that researcher Erica Windisch of Cyberdione Labs disclosed without coordinated notice on October 25, The Hacker News reported. The most serious is a race condition in Unix socket forwarding that runs a forwarded connection as root.

An administrator who read that report and wanted to act has nothing to act on. There is no version number to compare an install against, no advisory to route through a change process, and no catalog entry to trigger the kind of deadline CISA just set for PHP. The remediation count for these flaws is not low. It does not exist, because the thing it would count has not been published.

The sequence working

Wasmtime is the counterexample, and it is worth naming as one. It disclosed two sandbox escape flaws in its Cranelift compiler backend, CVE-2026-115889 and CVE-2026-115893, both rated 9.9, which could let a crafted WebAssembly module break out of the runtime. Fixed releases have been out since October 19 and no attacks have been reported, per The Hacker News.

Two flaws at the top of the severity scale produced no incident, because the order ran advisory first and exploitation never. That is what the process looks like when it is not interesting.

What actually gets counted

A severity score is a statement about the flaw. A 9.9 says what a bug can do to a system that has it, and it is published before anyone knows whether a single host will take the fix. The 19% is a statement about the world, and it is the more expensive number to produce: somebody has to scan the internet and count, and that somebody is usually not the vendor who shipped the patch.

Today's record carries two 9.9s and one 19%. The severity numbers arrived with the advisories; the exposure number arrived days later from a third party, and it is the only one of the three that describes how much of the risk is still live. Tailscale's flaws have neither figure, which is its own answer.

The gap this leaves is not a measurement problem, it is a reporting one. A published fix reads as a closed story in every channel that carries it, and PHP2Shell shows what that story is worth on the day: a catalog entry, a deadline for one class of operator, and roughly four in five visible hosts still waiting.