Oct 23: India has recorded a PHP2Shell impact rate of 14%, above the global average of 10%, according to Check Point Research. This places India among the 11th-highest impact-rate positions in the country rankings, alongside Norway and Ukraine at 13% and behind the European countries with higher reported rates.
What PHP2Shell is and why it matters
The two vulnerabilities sit in the PHP engine itself. That puts a vast range of technology in scope: websites and online stores running WordPress, Drupal, Joomla or Magento, shared hosting platforms, cPanel and Plesk control panels, and many commercial applications. An attacker can exploit the flaws to run their own code on a vulnerable server remotely, without logging in. That can lead to data theft, attacks on other connected systems, or service outages.
Two things have made the situation more urgent. Details of the vulnerabilities leaked before the planned disclosure, which gave attackers a head start and shortened the time defenders had to prepare. And screenshots of a PHP2Shell attack tool targeting the flaws have begun to circulate, a sign that exploitation is moving from theory to practice.
Europe has been hit more than twice as hard as other regions
14% of organisations in Europe have been impacted since disclosure, more than double the 6% recorded in North America, Latin America and APAC. Africa has the lowest regional rate at 4%.
16 of the 18 most affected countries are in Europe
Hungary has the highest impact rate in the world, with 38% of organisations affected since disclosure. Denmark follows at 32% and Austria at 28%, with Sweden and Romania at 22% each. Portugal, Thailand and Serbia each recorded 17%, followed by Germany at 16% and the Netherlands at 15%. India recorded 14%, Norway and Ukraine 13%, and Czechia, Poland, Spain, Switzerland and the United Kingdom 12% each. Thailand and India are the only countries outside Europe in that group. Just behind them, Turkey recorded 11%, and Ireland, Brazil and Italy 10%.
Lotem Finkelstein, Vice President of Research, Check Point Software Technologies
"The concern surrounding PHP2Shell stems from the combination of the vulnerabilities' severity and the widespread use of PHP, which underpins websites, e-commerce platforms, and many enterprise services. The two critical vulnerabilities could allow attackers to execute code remotely, and the leak of their details ahead of the planned disclosure is narrowing the window for security teams to prepare. Because these vulnerabilities reside in the PHP engine itself, updating a content management system or its plugins alone is not enough.
Addressing the threat starts with three things: understanding your exposure, ensuring your infrastructure can be patched quickly, and preparing compensating controls for cases where immediate patching is not possible. You cannot protect a system you do not know exists. Organizations therefore need to inventory all their PHP instances, including those in containers and third-party products, prioritize internet-facing servers, and pay particular attention to versions that are no longer supported. Identifying a vulnerability is important, but being able to fix it quickly is equally essential.
AI is accelerating vulnerability discovery and exploitation, leaving security teams less time to respond. Alongside preparing to deploy official updates as soon as they become available, organizations should activate layers of protection and monitor for suspicious activity, such as web server processes executing system commands, new files appearing on websites, or outbound connections to unknown destinations. We continue to monitor the situation and update our analysis as new information becomes available."
Telecoms and education are the most exposed industries
Telecommunications recorded the highest impact rate at 20%, twice the global rate, followed by education at 18%. Media and entertainment and associations and non-profits each recorded 16%. Agriculture and transportation and logistics each recorded 14%, followed by software and healthcare and medical at 13%. Information technology recorded 12% and business services 11%.
Real estate, rentals and leasing; automotive; aerospace and defence; industrial manufacturing; and government each recorded 9%. Hardware and semiconductors, consumer goods and services, financial services, and construction and engineering each recorded 8%. Wholesale and distribution recorded 7%, while energy and utilities and hospitality, travel and recreation each recorded 6%. Biotech and pharmaceuticals recorded the lowest rate of the 23 industries tracked, at 5%.
