LH033 checkpoint, 25 October 2026: baseline
Working record, unreviewed. Read at 08:55 UTC (Censys, W3Techs, Packagist) and 08:57 UTC (php.net release dates), after the brief was committed at 08:55 (c96b023). Tables: data/read-2026-10-25T0855Z/tables.json (scripts/tabulate.py 2026-10-25T0855Z); Python comparators: data/python_side.json (scripts/python_side.py). Censys's snapshot says it was refreshed at 08:15 UTC. Only completed UTC days are used, so the series runs from day 0 (21 October) to day 3 (24 October).
Censys: the share of version-reporting services in each fixed branch that it counts as patched (observation, its classification)
| Branch | Day 0 | Day 1 | Day 2 | Day 3 | Services in branch, day 3 |
|---|---|---|---|---|---|
| 8.2 | 2.1% | 22.1% | 41.2% | 46.1% | 5.7 million |
| 8.3 | 1.8% | 23.8% | 42.2% | 45.9% | 7.4 million |
| 8.4 | 4.3% | 35.3% | 58.5% | 62.3% | 3.1 million |
| 8.5 | 1.9% | 36.1% | 70.5% | 73.3% | 3.0 million |
8.4 and 8.5 passed half on day 2; 8.2 and 8.3 had not by day 3. Censys's own caveats apply in full: a service counts as patched only after a rescan, which can lag by up to about a week; distribution builds that backport the fix keep reporting the old version (Ubuntu's fixed noble package reports 8.3.6), so these shares are floors on protection; and services that hide their version are outside both numerator and denominator.
Censys: the tail no fix reaches
Services on branches PHP did not fix (8.1 and older, as Censys classes affected_nofix) were 23.3 to 23.5 million each day, 57.2 per cent of version-reporting services on day 0 and 55.1 per cent on day 3; most of that share is the unchanged size of the old branches, and the fall is the fixed branches growing as more services are seen. The largest are 7.4 (7.9 million services in the current snapshot), 8.1 (2.7 million), 7.2 (2.3 million), 5.6 (2.1 million) and 5.2 (2.0 million). Services reporting no version rose from 16.2 million on day 0 to 53.6 million on day 2 and 56.3 million on day 3, from 28 to 57 per cent of all PHP services Censys counted; the total grew from 56.9 to 98.9 million. That jump is in Censys's detection, not in the internet, and is why the brief's measures use shares within the version-reporting services.
W3Techs: websites at or above the fixed patch, within each minor (observation, its classification, dated 25 October 2026)
8.2: 1.9 per cent; 8.3: 2.6; 8.4: 4.2; 8.5: 5.9. W3Techs visits each site about once a month, so four days after the release most of its sample has not been looked at since; this is expected to be low and is a different instrument, not a contradiction of Censys.
Packagist: the flow-side tail (observation, its classification)
In September 2026, 583.7 million of 5,809.9 million Composer installs logged by Packagist (10.0 per cent) came from PHP 8.1 or older, branches PHP did not fix.
Beside the Python figures (derived; different units)
The comparators named in the brief, from LH011's and LH008's retained tables:
- LH008's four Python security fixes reached between 53.8 and 60.8 per cent of their library's downloads on day 1 and 52.7 to 63.7 per cent on day 2 (at that version or newer); the median across the 37 top projects' releases was 57.6 per cent on day 1 and 57.2 on day 2.
- Of 102 pinned repository pairs on those four fixes, 18 had moved to the fix within 7 days and 50 within 30.
So, as a description only: on day 1, the Censys patched share in each PHP branch (22 to 36 per cent) was below the download share the Python fixes had on their day 1, and on day 2 branch 8.4 (58.5 per cent) was within the Python fixes' day-2 range, 8.5 (70.5) above it, and 8.2 and 8.3 (41 to 42) below it. A download share counts fetches in a day; a Censys share counts standing services as last rescanned; the two are not the same quantity, and the Censys figures are floors for the reasons above. No cause is read into either. The Python curves rose slowly over the following month (to 57.3 to 72.3 per cent on day 30 for the four fixes); whether the PHP curves level off similarly is what the remaining reads measure.
Working chart
Drawn by scripts/draw_figure.py from the latest read and LH011's retained table; it is redrawn with each daily read, so it shows the latest completed day, not this checkpoint's. Unreviewed.
Not checked
Censys's general terms; what Censys counts as a service seen "later on a fixed one" when a service first appears already fixed; whether Censys revises earlier days (the next read will show); W3Techs's version detection.
From studies/LH033/checkpoints/2026-10-25.md in the repository, last changed 25 October 2026.