Probably more useful to focus on remote vulnerabilities that matter like CVE-2012-0830 which affected 5.3.9 of which according to the post 0.14% run. Also many

Probably more useful to focus on remote vulnerabilities that matter like CVE-2012-0830 which affected 5.3.9 of which according to the post 0.14% run. Also many bugs are highly config dependent like CVE-2012-1823 which is serious but only affects apache with a specific config. So counting a version increment to indicate level of vulnerability - you probably need to add to the survey to get a real indication of the level of vulnerability out there. However, it's interesting data of what's out there so thanks to the author for that. Most of the infections we see are default installations that haven't been configured and a bot raced in and infected. Or old PHP apps, themes, plugins or components like thumbnailers that were the vector. Targeting PHP itself is quite rare because there are so many vectors via the PHP applications themselves that it's not needed if you just want to own a few thousand boxes for your botnet.