56 million PHP and 5.5 million Node.js fingerprints: why a huge base cannot tell you who is exploitable

ZoomEye's queries have revealed a staggering number of PHP and Node.js fingerprints, totaling 56.8 million and 5.5 million, respectively. These figures, recorded on October 22, 2026, demonstrate the vast scale of these technologies' presence online. However, the sheer count of these fingerprints does not equate to a corresponding number of exploitable systems.

The PHP2Shell disclosure highlights this, showing that knowing a system is running a particular runtime (PHP or Node.js) is not enough to determine if it's vulnerable. This distinction is crucial, as the PHP2Shell vulnerability, which affects numerous PHP versions, is not visible from the outside and depends on internal factors such as the PHP version, SAPI, and whether the patched release has been applied and the worker process restarted.

The Node.js results offer a clearer picture, with a search for the server header returning only 155 matches. This disparity emphasizes that a large fingerprint count signifies a broad presence rather than a large population of vulnerable systems. The key to understanding and addressing the risks lies in enumerating the runtime version per host through authenticated checks, not just relying on surface-level fingerprints.

This approach, while requiring internal data not typically supplied by scanners, is the only method that can answer the question of which systems are actually exploitable.