{"id":64,"date":"2015-12-09T13:45:51","date_gmt":"2015-12-09T02:45:51","guid":{"rendered":"https:\/\/content.developerjack.com\/?p=64"},"modified":"2018-03-03T13:46:27","modified_gmt":"2018-03-03T02:46:27","slug":"php-version-roundup","status":"publish","type":"post","link":"https:\/\/developerjack.com\/blog\/2015\/php-version-roundup\/","title":{"rendered":"PHP Version Roundup"},"content":{"rendered":"\n<p>Last year, Anthony Ferrara posted an excellent round up of\u00a0<a href=\"http:\/\/blog.ircmaxell.com\/2014\/12\/php-install-statistics.html\">PHP versions in the wild<\/a>, specifically focusing on the volume of un-patched versions running production websites. Even as an estimate it was an eyeopening moment for many people.<\/p>\n\n\n\n<p>12 months on I\u2019ve reproduced this report focusing on:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n    <li>patch version fragmentation<\/li>\n    <li>% change in install numbers<\/li>\n    <li>% of installations running an insecure or out of date PHP version.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Introduction<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Methodology<\/h3>\n\n\n\n<p>Matching Anthony\u2019s approach, data is taken from\u00a0<a href=\"http:\/\/w3techs.com\/technologies\/details\/pl-php\/all\/all\">w3techs.com<\/a>. No raw figures are published publicly, but percentages of usage are taken from roughly the top 10 million sites on the web as listed by Alexa.com. The full details on report data is available from their\u00a0<a href=\"http:\/\/w3techs.com\/faq\">FAQ<\/a>\u00a0but suffice to say I\u2019m happy that its a good estimate of adoption.<\/p>\n\n\n\n<p>This year I:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n    <li>Forked Anthony\u2019s original spreadsheet for my own edits (the full copy\u00a0<a href=\"https:\/\/docs.google.com\/spreadsheets\/d\/1jf48GtxDRF-Pqk4M40OaA41cJYjUGmuGI4wUgz7ufW0\/edit?usp=sharing\">is publicly available here<\/a>)<\/li>\n    <li>Updated the relevant stats.<\/li>\n    <li>Poked around with the data a little bit<\/li>\n    <li>Created some pretty graphs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">What is \u2018secure\u2019<\/h3>\n\n\n\n<p>As with Anthony\u2019s report last year, I class a version as \u2018secure\u2019 if it is:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n    <li>Supported by PHP officially (i.e. the latest secure patch)<\/li>\n    <li>Supported by a popular, stable linux distribution<\/li>\n<\/ul>\n\n\n\n<p>For this report (and matching last years included distributions) I\u2019ve not included Windows binaries.<\/p>\n\n\n\n<p>The operating systems and versions included are:<\/p>\n\n\n\n<table class=\"wp-block-table\">\n    <thead>\n        <tr>\n            <th>Maintainer<\/th>\n            <th>OS\/distro version<\/th>\n            <th>PHP Version<\/th>\n        <\/tr>\n    <\/thead>\n    <tbody>\n        <tr>\n            <td>Ubuntu<\/td>\n            <td>15.10<\/td>\n            <td>5.6.11<\/td>\n        <\/tr>\n        <tr>\n            <td>Ubuntu<\/td>\n            <td>15.04<\/td>\n            <td>5.6.4<\/td>\n        <\/tr>\n        <tr>\n            <td>Ubuntu<\/td>\n            <td>14.04<\/td>\n            <td>5.5.9<\/td>\n        <\/tr>\n        <tr>\n            <td>Ubuntu<\/td>\n            <td>12.04<\/td>\n            <td>5.3.10<\/td>\n        <\/tr>\n        <tr>\n            <td>Debian<\/td>\n            <td>8<\/td>\n            <td>5.6.14<\/td>\n        <\/tr>\n        <tr>\n            <td>Debian<\/td>\n            <td>7<\/td>\n            <td>5.4.45<\/td>\n        <\/tr>\n        <tr>\n            <td>Debian<\/td>\n            <td>6<\/td>\n            <td>5.3.3<\/td>\n        <\/tr>\n        <tr>\n            <td>Debian<\/td>\n            <td>(LTS) 6<\/td>\n            <td>5.3.3*<\/td>\n        <\/tr>\n        <tr>\n            <td>CentOS<\/td>\n            <td>7<\/td>\n            <td>5.4.16<\/td>\n        <\/tr>\n        <tr>\n            <td>CentOS<\/td>\n            <td>6.7<\/td>\n            <td>5.3.3<\/td>\n        <\/tr>\n        <tr>\n            <td>CentOS<\/td>\n            <td>5.11<\/td>\n            <td>5.1.6<\/td>\n        <\/tr>\n        <tr>\n            <td>PHP<\/td>\n            <td>7.0.0<\/td>\n            <td>7.0.0<\/td>\n        <\/tr>\n        <tr>\n            <td>PHP<\/td>\n            <td>5.6.16<\/td>\n            <td>5.6.16<\/td>\n        <\/tr>\n        <tr>\n            <td>PHP<\/td>\n            <td>5.5.30<\/td>\n            <td>5.5.30<\/td>\n        <\/tr>\n        <tr>\n            <td>Fedora<\/td>\n            <td>22<\/td>\n            <td>5.6.16<\/td>\n        <\/tr>\n        <tr>\n            <td>Fedora<\/td>\n            <td>23<\/td>\n            <td>5.6.16<\/td>\n        <\/tr>\n    <\/tbody>\n<\/table>\n\n\n\n<p>It\u2019s also worth noting that Zend offer commercial\u00a0<a href=\"http:\/\/www.zend.com\/en\/support-center\/support\/php-long-term-support\">Long Term Support<\/a>\u00a0for PHP versions beyond the standard EOL. For example they\u2019ll officially support 5.3 (unspecified patch version) until February 2017. For the purposes of this report, Zend\u2019s commercial support is not included in the list of secure releases.<\/p>\n\n\n\n<p><em>* Debian 6 LTS package repository lists 5.3.3.1 as the PHP version<\/em><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Data &amp; Tables<\/h3>\n\n\n\n<p>The report is grouped into each minor release of PHP (e.g. 5.4).<\/p>\n\n\n\n<p>For each patch version I\u2019ve listed the patch release, the % of installs and the % that are secure.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n    <li><strong>% of installs<\/strong>\u00a0is the % of overall PHP installs<\/li>\n    <li><strong>% secure<\/strong>\u00a0is the % of overall PHP installs that is considered secure. i.e. 0% if its insecure.<\/li>\n<\/ul>\n\n\n\n<p>There is also a summary of the minor version including:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n    <li><strong>% of php versions<\/strong>\u00a0is the total adoption of the minor version compared with the overall PHP install list.<\/li>\n    <li><strong>% of which were secure<\/strong>\u00a0is the % of patches within that minor version that are considered secure.<\/li>\n    <li><strong>% secure of overall installs<\/strong>\u00a0which is the % of minor versions that were secure compared with the overall PHP install list.<\/li>\n<\/ul>\n\n\n\n<p>For example according to last years figures: &gt; In 2014, PHP 5.6.x was 0.4% of all PHP versions; only 6.7% of all 5.6.x installations were secure; meaning 0.03% to the overall list of secure installations were a 5.6.x version.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Graphs<\/h3>\n\n\n\n<p>For each minor version I\u2019ve provided two graphs. The first shows the fragmentation breakdown of patch versions across the whole release (e.g. 5.6.0 right through to 5.6.16). Those shaded in green are considered \u2018secure\u2019 and those greyed out are considered \u2018insecure\u2019.<\/p>\n\n\n\n<p>I\u2019ve also provided a chart showing the breakdown of the secure versions. This was predominantly for personal interest to see which secure patch releases were popular and potentially whether or not that indicates popularity of a particular OS\/version etc.<\/p>\n\n\n\n<p><strong><em>Graphs are\u00a0<a href=\"https:\/\/docs.google.com\/spreadsheets\/d\/1jf48GtxDRF-Pqk4M40OaA41cJYjUGmuGI4wUgz7ufW0\/edit?usp=sharing\">embedded from Google Sheets<\/a><\/em><\/strong>\u00a0<br\/><em>If you have issues viewing embedded graphs please review the spreadsheet directly.<\/em><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Attributions<\/h3>\n\n\n\n<p>Before I dive into the numbers I want to briefly thank\u00a0<a href=\"https:\/\/www.twitter.com\/ircmaxell\">Anthony Ferrara<\/a>\u00a0for his work last year and for sanity checking my analysis this year, and\u00a0<a href=\"https:\/\/twitter.com\/dshafik\">Davey Shafik<\/a>\u00a0for reminding me of Zend\u2019s commercial version support. A very big thank you to\u00a0<a href=\"https:\/\/www.twitter.com\/developerwil\">Wil Brown<\/a>\u00a0and\u00a0<a href=\"https:\/\/www.twitter.com\/glasnt\">Katie McLaughlin<\/a>\u00a0for helping review my numbers and graphs. Katie I promise I\u2019ll do nicer graphs next time!\u00a0<em>Edit<\/em>: Thank you\u00a0<a href=\"https:\/\/www.twitter.com\/bendechrai\">Ben Dechrai<\/a>\u00a0for sprucing up my twitter infographic!<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">PHP 5.6<\/h2>\n\n\n\n<p>Diving straight into the stats, I\u2019ve summarised each patch release against the % of overall PHP installs, and the % of which are classed as secure.<\/p>\n\n\n\n<table class=\"wp-block-table\">\n    <thead>\n        <tr>\n            <th>Version<\/th>\n            <th>% of installs<\/th>\n            <th>% secure<\/th>\n        <\/tr>\n    <\/thead>\n    <tbody>\n        <tr>\n            <td>5.6.16<\/td>\n            <td>0.08%<\/td>\n            <td>0.08%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.6.15<\/td>\n            <td>1.04%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.6.14<\/td>\n            <td>1.12%<\/td>\n            <td>1.12%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.6.13<\/td>\n            <td>0.86%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.6.12<\/td>\n            <td>0.23%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.6.11<\/td>\n            <td>0.18%<\/td>\n            <td>0.18%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.6.10<\/td>\n            <td>0.14%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.6.9<\/td>\n            <td>0.18%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.6.8<\/td>\n            <td>0.12%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.6.7<\/td>\n            <td>0.11%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.6.6<\/td>\n            <td>0.08%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.6.5<\/td>\n            <td>0.11%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.6.4<\/td>\n            <td>0.06%<\/td>\n            <td>0.06%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.6.3<\/td>\n            <td>0.06%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.6.2<\/td>\n            <td>0.12%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.6.1<\/td>\n            <td>0.04%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.6.0<\/td>\n            <td>0.14%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n    <\/tbody>\n<\/table>\n\n\n\n<p>PHP 5.6 is still a small portion of the overall install base at just 4.7%. It has however seen over 10 fold increase in adoption from last year which is fantastic! Interestingly however there are substantially more of these installs that are \u2018secure\u2019, jumping from 0.3% last year to 1.45% this year, luckily though it hasn\u2019t matched the popularity increase which suggests developers are upgrading to secure versions and maintaining them (go team!)<\/p>\n\n\n\n<iframe loading=\"lazy\" width=\"450\" height=\"271\" src=\"https:\/\/docs.google.com\/spreadsheets\/d\/1jf48GtxDRF-Pqk4M40OaA41cJYjUGmuGI4wUgz7ufW0\/pubchart?oid=2044041536&amp;format=interactive\"><\/iframe>\n\n\n\n<iframe loading=\"lazy\" width=\"450\" height=\"371\" src=\"https:\/\/docs.google.com\/spreadsheets\/d\/1jf48GtxDRF-Pqk4M40OaA41cJYjUGmuGI4wUgz7ufW0\/pubchart?oid=1150601610&amp;format=interactive\"><\/iframe>\n\n\n\n<p>I also found it curious that the majority of the secure installs were running 5.6.14 instead of the latest PHP official 5.6.16 release. The only linux distribution to officially support 5.6.14 is Debian Jessie (released April 2015) which suggests Jessie may be the OS of choice when it comes to upgrades.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">PHP 5.6 Summary<\/h3>\n\n\n\n<table class=\"wp-block-table\">\n    <thead>\n        <tr>\n            <th>Year<\/th>\n            <th>% of php versions<\/th>\n            <th>% of which were secure<\/th>\n            <th>% secure of overall installs<\/th>\n        <\/tr>\n    <\/thead>\n    <tbody>\n        <tr>\n            <td>2014<\/td>\n            <td>0.4%<\/td>\n            <td>6.7%<\/td>\n            <td>0.03%<\/td>\n        <\/tr>\n        <tr>\n            <td>2015<\/td>\n            <td>4.7%<\/td>\n            <td>30.8%<\/td>\n            <td>1.45%<\/td>\n        <\/tr>\n    <\/tbody>\n<\/table>\n\n\n\n<h2 class=\"wp-block-heading\">PHP 5.5<\/h2>\n\n\n\n<p>Last year PHP 5.5 was a little sad with 6% adoption, 36.6% of which were considered secure.<\/p>\n\n\n\n<p>This year its still particularly sad, albeit marginally better from the secure standpoint with a jump from 36.6% to 56.2% of all patch versions at a secure release.<\/p>\n\n\n\n<table class=\"wp-block-table\">\n    <thead>\n        <tr>\n            <th>Version<\/th>\n            <th>% of installs<\/th>\n            <th>% secure<\/th>\n        <\/tr>\n    <\/thead>\n    <tbody>\n        <tr>\n            <td>5.5.30<\/td>\n            <td>3.97%<\/td>\n            <td>3.97%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.5.29<\/td>\n            <td>1.20%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.5.28<\/td>\n            <td>0.61%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.5.27<\/td>\n            <td>0.44%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.5.26<\/td>\n            <td>0.61%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.5.25<\/td>\n            <td>0.37%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.5.24<\/td>\n            <td>0.30%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.5.23<\/td>\n            <td>0.24%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.5.22<\/td>\n            <td>0.43%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.5.21<\/td>\n            <td>0.34%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.5.20<\/td>\n            <td>0.18%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.5.19<\/td>\n            <td>0.18%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.5.18<\/td>\n            <td>0.16%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.5.17<\/td>\n            <td>0.13%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.5.16<\/td>\n            <td>0.12%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.5.15<\/td>\n            <td>0.12%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.5.14<\/td>\n            <td>0.15%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.5.13<\/td>\n            <td>0.06%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.5.12<\/td>\n            <td>0.22%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.5.11<\/td>\n            <td>0.15%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.5.10<\/td>\n            <td>0.06%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.5.9<\/td>\n            <td>4.35%<\/td>\n            <td>4.35%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.5.8<\/td>\n            <td>0.04%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.5.7<\/td>\n            <td>0.07%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.5.6<\/td>\n            <td>0.03%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.5.5<\/td>\n            <td>0.03%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.5.4<\/td>\n            <td>0.03%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.5.3<\/td>\n            <td>0.15%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.5.2<\/td>\n            <td>0.00%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.5.1<\/td>\n            <td>0.03%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.5.0<\/td>\n            <td>0.03%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n    <\/tbody>\n<\/table>\n\n\n\n<p>PHP 5.5 is as one would expect slightly more fragmented between patch versions, purely because there\u2019s been more of them and people don\u2019t upgrade.<\/p>\n\n\n\n<p>This graph shows just how fragmented the releases are &#8211; it\u2019s almost as bad as Android devices! Remembering that the green shading indicates a patch release that is considered secure.<\/p>\n\n\n\n<iframe loading=\"lazy\" width=\"440\" height=\"271\" src=\"https:\/\/docs.google.com\/spreadsheets\/d\/1jf48GtxDRF-Pqk4M40OaA41cJYjUGmuGI4wUgz7ufW0\/pubchart?oid=1817503714&amp;format=interactive\"><\/iframe>\n\n\n\n<p>What is perhaps not so surprising is the breakdown of secure versions &#8211; only 5.5.30 and 5.5.9 are supported (and 5.5.9 is due to Ubuntu 14.04.LTS so we\u2019ll see this one around for a while). As for 5.5.30 it wouldn\u2019t surprise me if the performance improvements in 5.5 prompted developers to push for 3rd party supported package repositories which were kept patched and up to date. This of course, is pure speculation.<\/p>\n\n\n\n<iframe loading=\"lazy\" width=\"440\" height=\"330\" src=\"https:\/\/docs.google.com\/spreadsheets\/d\/1jf48GtxDRF-Pqk4M40OaA41cJYjUGmuGI4wUgz7ufW0\/pubchart?oid=1089651805&amp;format=interactive\"><\/iframe>\n\n\n\n<p>Despite PHP 5.5 already entering the security phase of its EOL we\u2019re still seeing a substantial increase in its adoption, over double that as measured in 2014; from 6% to 14.8% in 12 months.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">PHP 5.5 Summary<\/h3>\n\n\n\n<table class=\"wp-block-table\">\n    <thead>\n        <tr>\n            <th>Year<\/th>\n            <th>% of php versions<\/th>\n            <th>% of which were secure<\/th>\n            <th>% secure of overall installs<\/th>\n        <\/tr>\n    <\/thead>\n    <tbody>\n        <tr>\n            <td>2014<\/td>\n            <td>6%<\/td>\n            <td>36%<\/td>\n            <td>2.19%<\/td>\n        <\/tr>\n        <tr>\n            <td>2015<\/td>\n            <td>14.8%<\/td>\n            <td>56.2%<\/td>\n            <td>8.32%<\/td>\n        <\/tr>\n    <\/tbody>\n<\/table>\n\n\n\n<h2 class=\"wp-block-heading\">PHP 5.4<\/h2>\n\n\n\n<p>PHP 5.4 has the most patch releases in the 5.x series with 45 point releases before EOL and old age set in.<\/p>\n\n\n\n<table class=\"wp-block-table\">\n    <thead>\n        <tr>\n            <th>Version<\/th>\n            <th>% of installs<\/th>\n            <th>% secure<\/th>\n        <\/tr>\n    <\/thead>\n    <tbody>\n        <tr>\n            <td>5.4.45<\/td>\n            <td>8.87%<\/td>\n            <td>8.87%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.44<\/td>\n            <td>1.51%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.43<\/td>\n            <td>3.11%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.42<\/td>\n            <td>1.36%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.41<\/td>\n            <td>1.54%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.40<\/td>\n            <td>0.92%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.39<\/td>\n            <td>1.29%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.38<\/td>\n            <td>0.80%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.37<\/td>\n            <td>0.80%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.36<\/td>\n            <td>1.23%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.35<\/td>\n            <td>0.80%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.34<\/td>\n            <td>0.68%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.33<\/td>\n            <td>0.68%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.32<\/td>\n            <td>0.46%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.31<\/td>\n            <td>0.34%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.30<\/td>\n            <td>0.65%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.29<\/td>\n            <td>0.34%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.28<\/td>\n            <td>0.40%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.27<\/td>\n            <td>0.52%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.26<\/td>\n            <td>0.34%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.25<\/td>\n            <td>0.22%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.24<\/td>\n            <td>0.40%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.23<\/td>\n            <td>0.22%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.22<\/td>\n            <td>0.15%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.21<\/td>\n            <td>0.15%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.20<\/td>\n            <td>0.15%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.19<\/td>\n            <td>0.12%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.18<\/td>\n            <td>0.03%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.17<\/td>\n            <td>0.15%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.16<\/td>\n            <td>1.02%<\/td>\n            <td>1.02%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.15<\/td>\n            <td>0.06%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.14<\/td>\n            <td>0.12%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.13<\/td>\n            <td>0.06%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.12<\/td>\n            <td>0.03%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.11<\/td>\n            <td>0.06%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.10<\/td>\n            <td>0.03%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.9<\/td>\n            <td>0.12%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.8<\/td>\n            <td>0.03%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.7<\/td>\n            <td>0.06%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.6<\/td>\n            <td>0.12%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.5<\/td>\n            <td>0.03%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.4<\/td>\n            <td>0.80%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.3<\/td>\n            <td>0.03%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.2<\/td>\n            <td>0.00%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.1<\/td>\n            <td>0.00%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.4.0<\/td>\n            <td>0.03%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n    <\/tbody>\n<\/table>\n\n\n\n<p>Firstly its worth highlighting the consistent fragmentation across patch releases.<\/p>\n\n\n\n<iframe loading=\"lazy\" width=\"450\" height=\"371\" src=\"https:\/\/docs.google.com\/spreadsheets\/d\/1jf48GtxDRF-Pqk4M40OaA41cJYjUGmuGI4wUgz7ufW0\/pubchart?oid=432475362&amp;format=interactive\"><\/iframe>\n\n\n\n<p>Interestingly enough, 5.4.45 is probably so popular since its the officially supported version of Debian 7, attributing to 28.8% of the overall 5.4 install base.<\/p>\n\n\n\n<p>There are only two secure releases of 5.4, one (5.4.45) is supported by Debian 7 while 5.4.16 is supported by CentOS 7. It\u2019s worth recognising that CentOS follows RHEL package support hence it is a very strong driver for version selection and support.<\/p>\n\n\n\n<iframe loading=\"lazy\" width=\"450\" height=\"371\" src=\"https:\/\/docs.google.com\/spreadsheets\/d\/1jf48GtxDRF-Pqk4M40OaA41cJYjUGmuGI4wUgz7ufW0\/pubchart?oid=1955259305&amp;format=interactive\"><\/iframe>\n\n\n\n<p>There\u2019s some good and some bad with these stats. We\u2019ve seen a jump from 26.4% to 30.8% in adoption of the 5.4 series but more importantly the number of secure installs has jumped from 10.6% to 32.1%. It would seem that as with the 5.5 and 5.6 releases, developers increasingly upgrading to 5.4 are upgrading to\u00a0<strong>and maintaining a secure version.<\/strong><\/p>\n\n\n\n<p>It\u2019s not a comforting raw percentage, but it is good to see the rate of secure installs increase!<\/p>\n\n\n\n<p>Congrats PHP folks, you\u2019re (slowly) learning to patch your sh*t! Yay!<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">PHP 5.4 Summary<\/h3>\n\n\n\n<table class=\"wp-block-table\">\n    <thead>\n        <tr>\n            <th>Year<\/th>\n            <th>% of php versions<\/th>\n            <th>% of which were secure<\/th>\n            <th>% secure of overall installs<\/th>\n        <\/tr>\n    <\/thead>\n    <tbody>\n        <tr>\n            <td>2014<\/td>\n            <td>26.4%<\/td>\n            <td>10.6%<\/td>\n            <td>2.80%<\/td>\n        <\/tr>\n        <tr>\n            <td>2015<\/td>\n            <td>30.8%<\/td>\n            <td>32.1%<\/td>\n            <td>9.89%<\/td>\n        <\/tr>\n    <\/tbody>\n<\/table>\n\n\n\n<h2 class=\"wp-block-heading\">PHP 5.3<\/h2>\n\n\n\n<p>Released in\u00a0<a href=\"http:\/\/php.net\/ChangeLog-5.php#5.3.0\">June 2009<\/a>\u00a0PHP 5.3 just WON\u2019T DIE!. Thats 6.5 years and its still kicking along with official support from Debian 6 and Ubuntu 12.04.<\/p>\n\n\n\n<table class=\"wp-block-table\">\n    <thead>\n        <tr>\n            <th>Version<\/th>\n            <th>% of installs<\/th>\n            <th>% secure<\/th>\n        <\/tr>\n    <\/thead>\n    <tbody>\n        <tr>\n            <td>5.3.30<\/td>\n            <td>0.00%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.3.29<\/td>\n            <td>13.39%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.3.28<\/td>\n            <td>3.28%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.3.27<\/td>\n            <td>1.36%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.3.26<\/td>\n            <td>0.64%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.3.25<\/td>\n            <td>0.21%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.3.24<\/td>\n            <td>0.21%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.3.23<\/td>\n            <td>0.39%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.3.22<\/td>\n            <td>0.14%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.3.21<\/td>\n            <td>0.18%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.3.20<\/td>\n            <td>0.14%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.3.19<\/td>\n            <td>0.21%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.3.18<\/td>\n            <td>0.21%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.3.17<\/td>\n            <td>0.25%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.3.16<\/td>\n            <td>0.11%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.3.15<\/td>\n            <td>0.25%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.3.14<\/td>\n            <td>0.18%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.3.13<\/td>\n            <td>0.71%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.3.12<\/td>\n            <td>0.00%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.3.11<\/td>\n            <td>0.00%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.3.10<\/td>\n            <td>2.96%<\/td>\n            <td>2.96%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.3.9<\/td>\n            <td>0.11%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.3.8<\/td>\n            <td>0.46%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.3.7<\/td>\n            <td>0.00%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.3.6<\/td>\n            <td>0.36%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.3.5<\/td>\n            <td>0.21%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.3.4<\/td>\n            <td>0.04%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.3.3<\/td>\n            <td>8.85%<\/td>\n            <td>8.85%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.3.2<\/td>\n            <td>0.68%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.3.1<\/td>\n            <td>0.04%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n        <tr>\n            <td>5.3.0<\/td>\n            <td>0.04%<\/td>\n            <td>0.00%<\/td>\n        <\/tr>\n    <\/tbody>\n<\/table>\n\n\n\n<iframe loading=\"lazy\" width=\"450\" height=\"341\" src=\"https:\/\/docs.google.com\/spreadsheets\/d\/1jf48GtxDRF-Pqk4M40OaA41cJYjUGmuGI4wUgz7ufW0\/pubchart?oid=339252701&amp;format=interactive\"><\/iframe>\n\n\n\n<p>There\u2019s not too much to highlight here, other than a lot of people aren\u2019t patching, and the few that are probably are sitting on an LTS release from Debian or Ubuntu.\u00a0<\/p>\n\n\n\n<iframe loading=\"lazy\" width=\"450\" height=\"341\" src=\"https:\/\/docs.google.com\/spreadsheets\/d\/1jf48GtxDRF-Pqk4M40OaA41cJYjUGmuGI4wUgz7ufW0\/pubchart?oid=1002080797&amp;format=interactive\"><\/iframe>\n\n\n\n<p>My personal curiosity sees that 5.3.3 is both a Debian 7 and CentOS 6.7 supported release. Since we assume a secure patch version indicates a stock\/supported OS, this indicates that Debian 7 and Centos 6.7 share a combined ~75% market share for this audience.\u00a0<em>Given they\u2019re running 5.3.x I\u2019d suggest they\u2019re the market share of users not interested in new shiny features or performance \ud83d\ude09<\/em>\u00a0I haven\u2019t analysed further which OS is more popular.<\/p>\n\n\n\n<p>It\u2019s also worth putting this in context because\u00a0<a href=\"http:\/\/php.net\/manual\/en\/migration54.incompatible.php\">PHP 5.4+ broke a\u00a0<em>lot<\/em>\u00a0of things<\/a>\u00a0including the removal of call time pass-by-reference, magic quotes and register_globals. For projects with a substantially old enough code history it\u2019s likely that dependance on the deprecated language features and settings could be a core blocker of upgrading rather than a disinterest in the lure of features, performance and security.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">PHP 5.3 Summary<\/h3>\n\n\n\n<p>Simply put, PHP 5.3 has declined in use over the past 12 months (as it should) but the portion of insecure installs remains roughly the same.<\/p>\n\n\n\n<table class=\"wp-block-table\">\n    <thead>\n        <tr>\n            <th>Year<\/th>\n            <th>% of php versions<\/th>\n            <th>% of which were secure<\/th>\n            <th>% secure of overall installs<\/th>\n        <\/tr>\n    <\/thead>\n    <tbody>\n        <tr>\n            <td>2014<\/td>\n            <td>45.9%<\/td>\n            <td>33.9%<\/td>\n            <td>15.56%<\/td>\n        <\/tr>\n        <tr>\n            <td>2015<\/td>\n            <td>35.7%<\/td>\n            <td>33.1%<\/td>\n            <td>11.82%<\/td>\n        <\/tr>\n    <\/tbody>\n<\/table>\n\n\n\n<h2 class=\"wp-block-heading\">Other Versions<\/h2>\n\n\n\n<p>PHP 5.2 and 5.1 still have a somewhat noteworthy install base however luckily 5.0 has &lt; 0.1% of all installs so I happily ignore 5.0. Sadly though 4.x still has a 1.3% install base across all PHP sites; fellow coders\u00a0<a href=\"http:\/\/php.net\/archive\/2007.php\">4.x was deprecated in 2007<\/a>\u00a0with security patches until August 2008 (thats more or less 8 years ago)!<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">PHP 5.2 Summary<\/h3>\n\n\n\n<p>PHP 5.2 has no actively supported versions by any distribution and yet it accounts for\u00a0<strong>13.1% of overall PHP installations &#8211; a slightly alarming statistic!<\/strong><\/p>\n\n\n\n<table class=\"wp-block-table\">\n    <thead>\n        <tr>\n            <th>Year<\/th>\n            <th>% of php versions<\/th>\n            <th>% of which were secure<\/th>\n            <th>% secure of overall installs<\/th>\n        <\/tr>\n    <\/thead>\n    <tbody>\n        <tr>\n            <td>2014<\/td>\n            <td>20.10%<\/td>\n            <td>0%<\/td>\n            <td>0%<\/td>\n        <\/tr>\n        <tr>\n            <td>2015<\/td>\n            <td>13.1%<\/td>\n            <td>0%<\/td>\n            <td>0%<\/td>\n        <\/tr>\n    <\/tbody>\n<\/table>\n\n\n\n<h3 class=\"wp-block-heading\">PHP 5.1 summary<\/h3>\n\n\n\n<p>PHP 5.1 is only actively supported by CentOS 5.11 with an EOL of March 2017. That\u2019s right. You can expect 5.1 to remain in production in another years time AND still be supported!<\/p>\n\n\n\n<table class=\"wp-block-table\">\n    <thead>\n        <tr>\n            <th>Year<\/th>\n            <th>% of php versions<\/th>\n            <th>% of which were secure<\/th>\n            <th>% secure of overall installs<\/th>\n        <\/tr>\n    <\/thead>\n    <tbody>\n        <tr>\n            <td>2014<\/td>\n            <td>1.2%<\/td>\n            <td>94.80%<\/td>\n            <td>1.14%<\/td>\n        <\/tr>\n        <tr>\n            <td>2015<\/td>\n            <td>0.9%<\/td>\n            <td>95.2%<\/td>\n            <td>0.86%<\/td>\n        <\/tr>\n    <\/tbody>\n<\/table>\n\n\n\n<h2 class=\"wp-block-heading\">What does this mean?<\/h2>\n\n\n\n<p>Ok so there\u2019s a lot of stats above, and even my head hurts trying to digest them. What does all this mean to developers?<\/p>\n\n\n\n<p>Firstly the overall version adoption is an important factor to the support roadmap of frameworks and libraries. With the release of 7.0 there\u2019s also an\u00a0<a href=\"https:\/\/marc.info\/?t=144940422800001&amp;r=1&amp;w=2\">ongoing discussion in internals<\/a>\u00a0as to what the PHP 5.6 support lifecycle will be (and hence when its EOL is to be expected).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Overall version adoption<\/h3>\n\n\n\n<iframe loading=\"lazy\" width=\"731\" height=\"319.07701278929756\" src=\"https:\/\/docs.google.com\/spreadsheets\/d\/1jf48GtxDRF-Pqk4M40OaA41cJYjUGmuGI4wUgz7ufW0\/pubchart?oid=1192867604&amp;format=interactive\"><\/iframe>\n\n\n\n<p>Particularly exciting is that 5.6, 5.5 and 5.4 are all substantially more popular this year than last year. With the reduced usage of 5.3 it seems developers have been upgrading a substantial number of their applications over the last 12 months.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">% of each version that is secure<\/h3>\n\n\n\n<iframe loading=\"lazy\" width=\"731\" height=\"311.30916666666667\" src=\"https:\/\/docs.google.com\/spreadsheets\/d\/1jf48GtxDRF-Pqk4M40OaA41cJYjUGmuGI4wUgz7ufW0\/pubchart?oid=1498189414&amp;format=interactive\"><\/iframe>\n\n\n\n<p>We can see that the increased adoption of 5.4, 5.5 and 5.6 is\u00a0<em>also<\/em>\u00a0resulting in a migration to secure versions! So not only are people upgrading but they\u2019re upgrading securely. Note however that these are percentages of the minor version, so whilst PHP 7 may show 90%, its 90% of only 0.1% of all PHP installs.<\/p>\n\n\n\n<p>It\u2019s also crucial we appreciate the \u2018gaps\u2019 here. Whilst 5.6 might look like its had an impressive % secure adoption, its evident that nearly 70% of installs are unpatched and insecure.<\/p>\n\n\n\n<p>So what does this mean overall? Enter graph three!<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">% of overall secure installs<\/h3>\n\n\n\n<iframe loading=\"lazy\" width=\"731\" height=\"306.39995950554135\" src=\"https:\/\/docs.google.com\/spreadsheets\/d\/1jf48GtxDRF-Pqk4M40OaA41cJYjUGmuGI4wUgz7ufW0\/pubchart?oid=1880477502&amp;format=interactive\"><\/iframe>\n\n\n\n<p>This is the real endgame of my analysis. Last year it was evident that most secure installs were 5.3. What\u2019s exciting this year is that 5.5 and 5.4 are contributing much more to the overall % (so sites who are secure are also more likely to be on a recent release).<\/p>\n\n\n\n<p>It\u2019s also exciting that this year we\u2019re seeing an estimated\u00a0<strong>32.42%<\/strong>\u00a0of PHP installs being assumed\u00a0<em>secure<\/em>. Considering last year was 21.73% thats a 49.19% increase in secure installs.<\/p>\n\n\n\n<p>Emphasis on\u00a0<em>increase<\/em>\u00a0of course\u2026 we\u2019re still looking at two thirds of PHP in the wild being assumed insecure.<\/p>\n\n\n\n<p>So PHP, well done on the secure improvements! Now lets make 2016 the upgrade year and remember to\u00a0<strong><em>\u2018Patch Yo Sh*t!\u2019<\/em><\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Last year, Anthony Ferrara posted an excellent round up of\u00a0PHP versions in the wild, specifically focusing on the volume of un-patched versions running production websites. Even as an estimate it was an eyeopening moment for many people. 12 months on I\u2019ve reproduced this report focusing on: patch version fragmentation % change in install numbers % [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[11,12],"class_list":["post-64","post","type-post","status-publish","format-standard","hentry","category-blog","tag-php","tag-security"],"_links":{"self":[{"href":"https:\/\/developerjack.com\/wp-json\/wp\/v2\/posts\/64","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/developerjack.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/developerjack.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/developerjack.com\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/developerjack.com\/wp-json\/wp\/v2\/comments?post=64"}],"version-history":[{"count":0,"href":"https:\/\/developerjack.com\/wp-json\/wp\/v2\/posts\/64\/revisions"}],"wp:attachment":[{"href":"https:\/\/developerjack.com\/wp-json\/wp\/v2\/media?parent=64"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/developerjack.com\/wp-json\/wp\/v2\/categories?post=64"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/developerjack.com\/wp-json\/wp\/v2\/tags?post=64"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}