India ranks 11th among countries hit by PHP2Shell attacks, 14% of organisations targeted: Report
The threat comes from two serious security flaws in PHP, a programming language used by millions of websites and online services. These vulnerabilities, known together as PHP2Shell, could allow hackers to take control of vulnerable servers without needing a password. Check Point said details of the flaws leaked ahead of their planned disclosure, giving attackers an early opportunity to target exposed systems.
:
What is PHP2Shell and why is it dangerous?
PHP2Shell refers to two vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619.
The flaws affect the PHP software running behind websites built using platforms such as WordPress, Drupal, Joomla and Magento.
For instance, a hacker targeting an unpatched online shopping website could potentially gain access to its server, steal information or disrupt services.
Check Point’s findings measure attempted exploitation. A recorded attack attempt does not necessarily mean hackers successfully breached an organisation.
:
India among world’s most targeted countries
Europe has recorded the highest regional impact, with 14% of organisations facing attacks. India and Thailand are the only countries outside Europe among the 18 most affected nations.
| Country | Organisations targeted |
|---|---|
| Hungary | 38% |
| Denmark | 32% |
| Austria | 28% |
| Sweden and Romania | 22% |
| Thailand | 17% |
| Germany | 16% |
| Netherlands | 15% |
| India | 14% |
| Global average | 10% |
Telecommunications companies face the highest industry exposure at 20%, followed by education at 18% and media and entertainment at 16%.
:
Updating WordPress alone will not fix the problem
The biggest concern is that the vulnerabilities exist inside PHP itself.
Check Point executive Charlotte Wilson warned, “The immediate priority is getting systems updated, but the bigger question is whether we’ve become too dependent on technology that can leave so many organisations vulnerable at exactly the same time.”
Security fixes are available in PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Organisations using older versions need to check for applicable vendor fixes or upgrade.
Website administrators should examine server logs, look for unfamiliar files and confirm that their hosting providers have installed the security updates.
Source: Check Point Research, October 22, 2026. The reported percentages represent organisations facing exploitation attempts, not confirmed successful breaches.