{
  "id": 16006036,
  "title": "56 million PHP and 5.5 million Node.js fingerprints: why a huge base cannot tell you who is exploitable",
  "url": "https://urgent.news/2026/10/22/56-million-php-and-5-5-million-node-js-fingerprints-why-a-huge-base",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-22T06:00:28.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/sorrelthorncroft/56-million-php-and-55-million-nodejs-fingerprints-why-a-huge-base-cannot-tell-you-who-is-41jg"
  },
  "original_language": "en",
  "account": "ZoomEye's queries have revealed a staggering number of PHP and Node.js fingerprints, totaling 56.8 million and 5.5 million, respectively. These figures, recorded on October 22, 2026, demonstrate the vast scale of these technologies' presence online. However, the sheer count of these fingerprints does not equate to a corresponding number of exploitable systems. The PHP2Shell disclosure highlights this, showing that knowing a system is running a particular runtime (PHP or Node.js) is not enough to determine if it's vulnerable. This distinction is crucial, as the PHP2Shell vulnerability, which affects numerous PHP versions, is not visible from the outside and depends on internal factors such as the PHP version, SAPI, and whether the patched release has been applied and the worker process restarted. The Node.js results offer a clearer picture, with a search for the server header returning only 155 matches. This disparity emphasizes that a large fingerprint count signifies a broad presence rather than a large population of vulnerable systems. The key to understanding and addressing the risks lies in enumerating the runtime version per host through authenticated checks, not just relying on surface-level fingerprints. This approach, while requiring internal data not typically supplied by scanners, is the only method that can answer the question of which systems are actually exploitable.",
  "summary": "56 million PHP and 5.5 million Node.js fingerprints: why a huge base cannot tell you who is exploitable Three ZoomEye queries run for this article produced numbers that dwarf everything else in the batch: app=\"PHP\" returned 56,809,811 matching assets, app=\"Node.js\" returned 5,522,163, and a narrower http.header.server=\"Node.js\" returned 155. All three were collected on 22 October 2026 within a…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}