Download websites that use KPHP

About KPHP

Compiling PHP into native binaries is meant to make the PHP disappear, which makes a compiler an odd thing to find in a website fingerprint at all. KPHP is filed in our index under Programming languages, targets PHP, and is published by VK (VKontakte) under a GPL v3 license, with our record dating it to 2020.

As of October 2026 the fingerprint appears on 11 sites. A population that small is the finding rather than a footnote. General-purpose runtimes spread through hosting panels and one-click installers and end up on enormous numbers of sites. A compiler built to solve one operator's scaling problem stays close to home, and the sites running it are usually running it deliberately, maintained by engineers who chose a non-standard toolchain and accepted the work that comes with it.

A category label of Programming languages can mislead a reader here. Finding a language listed against a site normally means the source running in production is written in it, and an analyst filtering for PHP deployments will pick up interpreter installations, hosting defaults and framework choices along the way. A compiled site is a different object. The source may be written in PHP, but what answers the request is a binary, so operational questions about configuration, extensions and runtime settings have different answers, and tooling that expects an interpreter will often report nothing at all.

Version data survives the compilation step, which is unexpectedly useful. We hold 4 distinct version strings and record 7.4.127539 in the version column. The shape of those strings repays a careful look, because they pair a language compatibility level with a long build counter, so what appears at first to be heavy version fragmentation is mostly build drift between deployments rather than a sequence of public releases. Anyone using version spread as a proxy for upgrade discipline should adjust for that before drawing conclusions.

The practical implication is patch flow. A site served by a compiled runtime does not consume upstream PHP security advisories the way an interpreter installation does, because a fix has to travel through the compiler project and then through a rebuild and a redeploy on the operator's own schedule. For anyone mapping exposure, a site on this runtime belongs in a different bucket from a site on stock PHP, and the two should not be scored against the same advisory feed.

Detection is weaker than the count on its own suggests. Compiled output announces itself only when an operator leaves a header, an error page or a build artefact in place, and any of those can be removed without breaking the site, so the deployed population is probably larger than what we observe. The argument for a list rather than a lookup follows directly from that. At this scale you cannot find the sites by guessing domains, and no directory of them exists anywhere else, so the export is the discovery mechanism and not just a convenience. With country, top-level domain and version columns attached, the detected set is enough to test whether use outside the vendor's own properties is a genuine pattern or a handful of related hosts under common management.