A day after PHP fixed PHP2Shell, about 3,000 of 409,494 servers on old, unfixed PHP versions had moved to a newer one (0.7%). On the fixed versions, 18% were already patched.
PHP only released updates for recent versions (8.2–8.5). Versions 5.4–7.3 are affected and get no official fix (a few vendors and volunteers patch old versions themselves); for most, the way out is moving the site to a newer PHP.
The flaw has the tech world on edge (rightly so). Government sites in Europe, Wikipedia and the Internet Archive went offline to be safe, and today RIPE NCC took three of its sites down as a precaution.