India has recorded a PHP2Shell impact rate of 14%, above the global average of 10%, according to Check Point Research. This places India among the 11th-highest impact-rate positions in the country rankings, alongside Norway and Ukraine at 13% and behind the European countries with higher reported rates.
What PHP2Shell is and why it matters
The two vulnerabilities sit in the PHP engine itself. That puts a vast range of technology in scope: websites and online stores running WordPress, Drupal, Joomla or Magento, shared hosting platforms, cPanel and Plesk control panels, and many commercial applications. An attacker can exploit the flaws to run their own code on a vulnerable server remotely, without logging in. That can lead to data theft, attacks on other connected systems, or service outages.
Two things have made the situation more urgent. Details of the vulnerabilities leaked before the planned disclosure, which gave attackers a head start and shortened the time defenders had to prepare. And screenshots of a PHP2Shell attack tool targeting the flaws have begun to circulate, a sign that exploitation is moving from theory to practice.
Europe has been hit more than twice as hard as other regions
14% of organisations in Europe have been impacted since disclosure, more than double the 6% recorded in North America, Latin America and APAC. Africa has the lowest regional rate at 4%.
16 of the 18 most affected countries are in Europe
Hungary has the highest impact rate in the world, with 38% of organisations affected since disclosure. Denmark follows at 32% and Austria at 28%, with Sweden and Romania at 22% each. Portugal, Thailand and Serbia each recorded 17%, followed by Germany at 16% and the Netherlands at 15%. India recorded 14%, Norway and Ukraine 13%, and Czechia, Poland, Spain, Switzerland and the United Kingdom 12% each. Thailand and India are the only countries outside Europe in that group. Just behind them, Turkey recorded 11%, and Ireland, Brazil and Italy 10%.
Lotem Finkelstein, Vice President of Research, Check Point Software Technologies"The concern surrounding PHP2Shell stems from the combination of the vulnerabilities' severity and the widespread use of PHP, which underpins websites, e-commerce platforms, and many enterprise services. The two critical vulnerabilities could allow attackers to execute code remotely, and the leak of their details ahead of the planned disclosure is narrowing the window for security teams to prepare. Because these vulnerabilities reside in the PHP engine itself, updating a content management system or its plugins alone is not enough.
Addressing the threat starts with three things: understanding your exposure, ensuring your infrastructure can be patched quickly, and preparing compensating controls for cases where immediate patching is not possible. You cannot protect a system you do not know exists. Organizations therefore need to inventory all their PHP instances, including those in containers and third-party products, prioritize internet-facing servers, and pay particular attention to versions that are no longer supported. Identifying a vulnerability is important, but being able to fix it quickly is equally essential.
AI is accelerating vulnerability discovery and exploitation, leaving security teams less time to respond. Alongside preparing to deploy official updates as soon as they become available, organizations should activate layers of protection and monitor for suspicious activity, such as web server processes executing system commands, new files appearing on websites, or outbound connections to unknown destinations. We continue to monitor the situation and update our analysis as new information becomes available."
Telecoms and education are the most exposed industries
Telecommunications recorded the highest impact rate at 20%, twice the global rate, followed by education at 18%. Media and entertainment and associations and non-profits each recorded 16%. Agriculture and transportation and logistics each recorded 14%, followed by software and healthcare and medical at 13%. Information technology recorded 12% and business services 11%.
Real estate, rentals and leasing; automotive; aerospace and defence; industrial manufacturing; and government each recorded 9%. Hardware and semiconductors, consumer goods and services, financial services, and construction and engineering each recorded 8%. Wholesale and distribution recorded 7%, while energy and utilities and hospitality, travel and recreation each recorded 6%. Biotech and pharmaceuticals recorded the lowest rate of the 23 industries tracked, at 5%.
Updating your website is not enough
Because the flaws are in PHP, updating WordPress, another content management system or its plugins does not close them. PHP has to be updated directly on the server. Fixes are available in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Version 8.1 and older remain vulnerable unless the fix is backported, which makes unsupported versions a particular concern.
"When governments are choosing to take their own websites offline rather than risk leaving them exposed, it gives you a pretty clear indication of how seriously this is being taken," said Charlotte Wilson, Head of Enterprise at Check Point Software Technologies. "The immediate priority is getting systems updated, but the bigger question is whether we've become too dependent on technology that can leave so many organisations vulnerable at exactly the same time."
What organisations should do now
Find every PHP instance. You cannot protect a system you do not know exists. Inventory PHP across your estate, including containers and third-party products.
Patch PHP on the server, starting with internet-facing systems. Move to a fixed version and pay particular attention to versions that are no longer supported.
Confirm with your hosting provider. If your website is externally hosted, ask your provider directly whether the patch has been applied.
Restart and verify. Restart the relevant services after updating and check they are actually running the patched version.
Restrict what you cannot patch quickly. Limit who can reach a vulnerable service, or take it offline temporarily until it can be secured.
Add layers of protection. Enable attack blocking, keep security protections up to date, and limit communication between web servers and the rest of the corporate network so a breach cannot spread easily. These measures buy time but do not replace updating PHP.
How to tell if you have already been targeted
Installing the patch will not remove any damage or malicious code attackers may already have left on a server. Organisations should check for signs of compromise, including:
Unexplained web service outages
New or unfamiliar PHP files appearing on websites
Unusual requests to web servers
Web server processes executing system commands
Server connections to unknown external addresses
How Check Point protects you
Check Point Intrusion Prevention System (IPS) protections are available
Check Point Web Application Firewall (WAF) preemptively protects against php2shell. We recommend enabling the latest signatures in Prevent mode for the best coverage and visibility
Check Point Exposure Management can assist you with mapping your PHP exposure and accelerating mitigation.
Check Point Research continues to monitor the situation and will update its analysis as new information becomes available.
𝐒𝐭𝐚𝐲 𝐢𝐧𝐟𝐨𝐫𝐦𝐞𝐝 𝐰𝐢𝐭𝐡 𝐨𝐮𝐫 𝐥𝐚𝐭𝐞𝐬𝐭 𝐮𝐩𝐝𝐚𝐭𝐞𝐬 𝐛𝐲 𝐣𝐨𝐢𝐧𝐢𝐧𝐠 𝐭𝐡𝐞 WhatsApp Channel now! 👈📲
𝑭𝒐𝒍𝒍𝒐𝒘 𝑶𝒖𝒓 𝑺𝒐𝒄𝒊𝒂𝒍 𝑴𝒆𝒅𝒊𝒂 𝑷𝒂𝒈𝒆𝐬 👉 Facebook, LinkedIn, Twitter, Instagram
