Security Exposure Survey 2026: PHP, HSTS and CVE exposure across 268,000 sites in Japan, the G7, Vietnam and Malaysia

• We requested 268,485 sites in 10 regions (Japan, US & generic TLDs, UK, Germany, France, Italy, Canada, Vietnam, Malaysia and a global top-sites list) with one ordinary page load each, and 121,903 answered. We only recorded what each server says about itself in its response.
• Japan has the lowest adoption on all 8 security controls we measured (HTTPS enforcement, HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, WAF/CDN in front). CSP is at 7.8% and HSTS at 18.1%; 11.3% of Japanese sites do not enforce HTTPS, against 1.5–4.1% elsewhere.
• End-of-life PHP is common everywhere. Among sites that disclose a PHP version, the share on a version that no longer receives security fixes ranges from 29.8% (Germany) to 64.2% (Vietnam). Japan is at 52.3%, and 24.0% of its PHP-disclosing sites still show PHP 5.x, the highest share of any region.
• About six in ten PHP-disclosing sites in most regions still show a version older than the fixed releases of the critical 2026 PHP vulnerabilities (CVSS 9.8). Germany (34.3%) is the exception. Japan is at 59.5%, and 64.1% among Japan's top-ranked sites.
• For vulnerability classes that can lead to remote code execution (RCE) or memory-corruption exploits, Japan's exposure is roughly twice that of the UK, US and Germany for RCE-class CVEs (3.5% vs 1.5%, 1.7%, 1.8%). For memory-corruption CVEs Japan (8.1%) is far above the UK (3.1%) but level with Germany (7.6%) and France (8.2%); Italy (10.1%) and Vietnam (16.2%) are higher.

Scope and method

Sample composition. Regions other than Japan were taken from the Tranco top-sites list by country-code TLD (UK: .uk/.co.uk; Germany: .de; France: .fr; Italy: .it; Canada: .ca; Vietnam: .vn; Malaysia: .my). "US & generic TLDs" is .us/.com/.net/.org excluding other countries' ccTLDs, so it is a proxy for the English-speaking web, not a list of US-hosted sites. "Global top sites" is the top of the Tranco list. Japan was sampled from three sources: Tranco (.jp), Majestic Million (.jp) and 130,070 domains from SiteScouter's own search history, which are domains users typed into a Japanese SEO tool and include many expired or parked domains (only 11.7% answered, against 66.3% for Tranco and 72.5% for Majestic). Comparisons between regions below use the full samples; where the Japanese sources differ materially we show them separately.

What "exposure" means here

"Exposure" in this report means the version string a server disclosed falls inside the affected range of a public CVE. Linux distributions often back-port fixes without changing the version string, and a WAF or CDN may block the attack path, so a flagged site may already be safe. The rates are upper bounds. We did not test whether any site can be exploited. The reverse also holds: sites that hide their version (74.3% of Japan's responding sites) are invisible to this method, and hiding a version is good hygiene but does not mean the software is up to date.

Security controls: Japan is last on all eight

(% of responding sites.)

The widest gap is HTTPS: 11.3% of Japanese sites (4,068) do not enforce HTTPS, against 1.5–4.1% elsewhere. A page that still loads over plain HTTP can be altered in transit, and login details can be captured.

Two caveats matter for fair reading:

• The UK's high header scores depend on Cloudflare. 78.2% of UK sites sit behind a WAF/CDN, and Cloudflare adds X-Frame-Options, X-Content-Type-Options and Referrer-Policy by default. Those numbers reflect a vendor default as much as site owners' decisions. Japan has the lowest WAF/CDN share (20.0%).
• The gap is not an artefact of Japan's long-tail sample. Japan's top-ranked (Tranco) sites alone score HSTS 27.5% and CSP 10.9%. That is above the UK on HSTS (22.9%) but below every other region on HSTS (30.7–51.9%) and below all regions on CSP (19.8–35.7%).

TLS 1.0 and 1.1 were not observed anywhere. The share of sites that stop at TLS 1.2 (no TLS 1.3) is 13.6% in Japan, 12.1% for US & generic TLDs, 4.2% in the UK and 20.3% in Vietnam.

A simple hygiene score (one point each for HTTPS enforced, HSTS, CSP, X-Frame-Options, X-Content-Type-Options, version hidden, valid certificate) averages 3.17 in Japan against 4.81 in the UK, 4.42 in Germany and 4.34 for US & generic TLDs. 10.9% of Japanese sites score 1 or less; in the UK it is 1.3%.

Version disclosure

Naming the exact version makes a target easier to pick. Our stance, though, is not "hide it" but "update first, then hide it". Hiding a version fixes nothing.

PHP: end-of-life versions are common in every region

Support status as of October 2026: PHP 8.1 and below no longer receive security fixes (end of life); 8.2 receives security fixes only until 31 December 2026; 8.3 and later are fully supported.

(PHP 5.x share = PHP 5.x sites ÷ PHP-disclosing sites, computed from the counts shown.)

Japan is not an outlier on the overall end-of-life rate (Vietnam and the global list are higher), but it is on the long tail of very old versions: 24.0% of its PHP-disclosing sites show PHP 5.x, the highest of any region. PHP 5.6, whose last release (5.6.40) shipped in January 2019, is the third most common minor version in Japan (453 sites).

The critical 2026 PHP vulnerabilities: how many sites still show an unpatched version

In 2026, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.8, CRITICAL) were published for PHP. They are use-after-free flaws triggered by longjmp() handling when memory runs out, and can mix memory contents between requests. That can expose another user's data or session, and can be abused for takeover. The fixed releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

Japan, split by sample source: Tranco top list 64.1% (600 of 936), Majestic Million 56.3% (605 of 1,075), search history 58.6% (638 of 1,088). Being a well-known site does not mean being patched.

Germany's low figure comes from both a younger version mix (500 of its 913 PHP-disclosing sites run 8.3 or later) and faster patching. Of Japan's 1,842 flagged sites that we could place in a version series (1 fewer than the headline figure because of how version strings were interpreted in the re-match), 759 are on 5.x or earlier and 549 on 7.4, so most would need a move to a supported series rather than a point update.

Public CVE matching

"RCE-class" covers CVEs whose weakness types allow remote command or code execution (e.g. CWE-77/78/94/502/434), the kind of flaw behind web-shell installation. "Memory-corruption" covers CWE-119/125/787/416 and similar. The most common RCE-class CVE, CVE-2024-3566 (PHP, CVSS 9.8), only affects Windows, so the main RCE column excludes it; including it, Japan is at 5.4%.

Reading it plainly: Japan's RCE-class exposure (3.5%) is about twice that of the UK, US and Germany, similar to France (3.4%) and Canada (3.5%), and below Vietnam (4.5%). On memory-corruption CVEs Japan (8.1%) is about 2.6 times the UK, but about the same as Germany (7.6%) and France (8.2%), and below Italy (10.1%) and Vietnam (16.2%). Japan is not the worst in this table, but it is clearly worse than the UK and the US on both.

Among web servers, Apache httpd shows very high CVE rates in every region (Japan 92.5%, US 84.5%, UK 84.7%, Germany 77.6% of version-disclosing sites). That mostly reflects the latest patch release (2.4.69) not yet being applied after a batch of memory-corruption CVEs affecting 2.4.68 and earlier, which is a different problem from years-old PHP 5.x left in place. It should move quickly in a re-survey. WordPress core is in much better shape (Japan: 22.1% of version-disclosing sites match a CVE); across the whole survey the current release is by far the most common version, and the matches concentrate on older 6.x releases.

Among Japan's 1,622 PHP-disclosing sites on an end-of-life version, all 1,622 fall inside the range of at least one public PHP CVE, 1,568 of them an RCE-class one. Among sites on supported series the figures are 23.3% (8.2) and 13.7% (8.3+), and those are mostly sites below 8.3.36 that have not applied the 2026 fixes. The same pattern, 100% on end-of-life versions and far lower on supported ones, appears in all six regions we compared.

A closer look at Japan by domain type

(PHP EOL share uses PHP-disclosing sites as the denominator. Categories with too few sites to avoid identifying individual sites are omitted.)

Government sites are comparatively strong on headers (HSTS 42.6%) but the sample is only 68 sites. Companies make up the largest group, and their results track the national average. Organizations and academic sites sit lower, with very little WAF/CDN protection (6.5% for or.jp).

What site owners should do

1. Update PHP and server software to a supported series, and to at least 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12. Back up first and check that your CMS, theme and plugins support the new version.
2. Then hide version strings (expose_php = Off, ServerTokens Prod, server_tokens off).
3. Enforce HTTPS and turn on HSTS. Start with a short max-age and increase it.
4. Add X-Content-Type-Options, X-Frame-Options, Referrer-Policy and CSP step by step. A CDN or WAF in front often supplies several by default.
5. Check certificate auto-renewal and cookie attributes (Secure, HttpOnly, SameSite).

Check your own site

SiteScouter's server information check uses the same non-intrusive method as this survey and shows what your server announces: Server and X-Powered-By headers, TLS version, certificate, security headers, cookie attributes and DNSBL listing. No registration is needed.

Method notes and limits

Sample. Regions other than Japan come from the Tranco top list by country-code TLD; Japan combines Tranco, Majestic Million and SiteScouter search history. Reading the numbers. Every exposure rate is an upper bound based on disclosed version strings. Details are in the FAQ below.

The author's blog post

A first-person write-up of why I ran this survey, and what to do about it, is on the author's blog (Yuki Nakazawa's blog). This page is the data article; the blog post is a separate, shorter piece.

FAQ

Is this an attack?

No. Each site received one DNS lookup, one TLS handshake and one HTTP GET, the same as opening it once in a browser. We did not port-scan, probe for vulnerabilities, attempt logins or send exploit traffic. Only public HTTP responses and public DNS data were used.

Does "exposure" mean the site is vulnerable?

No. It means the disclosed version string falls inside the affected range of a public CVE. Distribution back-ports, WAFs and CDNs can make a flagged site safe, so every exposure rate is an upper bound. We did not test exploitability.

Are individual sites named?

No. No domain names or company names are published anywhere in this report, and we do not release host-level data.

What about sites that did not answer?

Domains that did not resolve, did not respond or pointed to private addresses are excluded from the denominators. Most of Japan's 120,000 non-responding domains are thought to be expired domains from the search-history sample.

Is the data unaltered?

Results are stored append-only and aggregated read-only; no value was edited or removed. During aggregation we found that our first CVE-matching pass compared CPEs of other products, and re-matched all stored version strings with a corrected rule. Figures from the first pass are not used anywhere in this report.

How do I report an error or request a correction?

Contact the author using the details below.

References

Last checked: 2026-10-24. Specifications and policies can change; check the primary sources before acting.

• PHP: Supported Versions (php.net)
• NVD - National Vulnerability Database (NIST)
• Tranco: A Research-Oriented Top Sites Ranking
• The Majestic Million