India has recorded a PHP2Shell impact rate of 14%, above the global average of 10%, according to Check Point Research. That places India 11th in the country rankings. Norway and Ukraine sit just behind at 13%. European countries with higher rates are ahead of it.
What PHP2Shell Is and Why It Matters
PHP2Shell involves two vulnerabilities in the PHP engine itself. That puts a vast range of technology at risk. This includes websites and online stores running WordPress, Drupal, Joomla or Magento. It also covers shared hosting platforms, cPanel and Plesk control panels, and many commercial applications.
An attacker can use the flaws to run their own code on a vulnerable server remotely, without logging in. This can lead to data theft, attacks on connected systems or service outages.
Two things have made the situation more urgent. Details of the flaws leaked before the planned disclosure. That gave attackers a head start and cut the time defenders had to prepare. Screenshots of a PHP2Shell attack tool have also begun to circulate. This suggests exploitation is moving from theory to practice.
Lotem Finkelstein, Vice President of Research at Check Point Software Technologies, said the concern comes from the severity of the flaws and the wide use of PHP. PHP underpins websites, e-commerce platforms and many enterprise services. He said the leak is shrinking the window for security teams to prepare.
Europe Is Hit Hardest
Some 14% of organisations in Europe have been affected since disclosure. That is more than double the 6% recorded in North America, Latin America and APAC. Africa has the lowest regional rate, at 4%.
Sixteen of the 18 most affected countries are in Europe. Hungary has the highest rate in the world, at 38%. Denmark follows at 32% and Austria at 28%. Sweden and Romania are at 22% each. Portugal, Thailand and Serbia each recorded 17%, followed by Germany at 16% and the Netherlands at 15%.
India recorded 14%. Norway and Ukraine recorded 13%. Czechia, Poland, Spain, Switzerland and the United Kingdom recorded 12% each. Thailand and India are the only countries outside Europe in that group. Turkey is just behind at 11%, with Ireland, Brazil and Italy at 10% each.
Telecoms and Education Are Most Exposed
Telecommunications recorded the highest impact rate among industries, at 20%. That is twice the global rate. Education followed at 18%. Media and entertainment, and associations and non-profits, each recorded 16%. Agriculture, and transportation and logistics, each recorded 14%. Software and healthcare each recorded 13%. Information technology recorded 12% and business services 11%.
Real estate, automotive, aerospace and defence, industrial manufacturing and government each recorded 9%. Hardware and semiconductors, consumer goods and services, financial services, and construction and engineering each recorded 8%. Wholesale and distribution recorded 7%. Energy and utilities, and hospitality, travel and recreation, each recorded 6%. Biotech and pharmaceuticals recorded the lowest rate of the 23 industries tracked, at 5%.
Updating Your Website Is Not Enough
The flaws sit in PHP, so updating WordPress, another content management system or its plugins does not close them. PHP must be updated directly on the server. Fixes are available in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Version 8.1 and older remain vulnerable unless the fix is backported. That makes unsupported versions a particular concern.
Charlotte Wilson, Head of Enterprise at Check Point Software Technologies, said governments taking their own websites offline rather than risk exposure shows how seriously this is being treated. She said the immediate priority is to update systems. The bigger question, she added, is whether the world has become too dependent on technology that can leave so many organisations vulnerable at the same time.
What Organisations Should Do Now
Finkelstein said the response starts with three things. Organisations must understand their exposure, make sure they can patch quickly and prepare backup controls for cases where they cannot patch at once.
The first task is to find every PHP instance. You cannot protect a system you do not know exists. Organisations should inventory PHP across their estate, including containers and third-party products.
Next, patch PHP on the server, starting with internet-facing systems. Move to a fixed version, and pay close attention to versions that are no longer supported. If your site is hosted externally, ask your provider whether the patch has been applied. After updating, restart the relevant services and check that they are running the patched version.
Where patching cannot be done quickly, restrict access. Limit who can reach the vulnerable service, or take it offline until it is secure.
Add layers of protection as well. Turn on attack blocking and keep security protections up to date. Limit communication between web servers and the rest of the corporate network, so a breach cannot spread easily. These steps buy time but do not replace updating PHP.
Finkelstein added that AI is speeding up the discovery and exploitation of vulnerabilities, which leaves teams less time to respond. He said organisations should watch for suspicious activity. This includes web server processes running system commands, new files on websites and outbound connections to unknown destinations. Check Point continues to monitor the situation and will update its analysis as new information emerges.
How to Tell If You Have Already Been Targeted
Installing the patch will not remove damage or malicious code that attackers may already have left on a server. Organisations should check for signs of compromise. These include unexplained web service outages and new or unfamiliar PHP files on websites. Other signs are unusual requests to web servers, web server processes running system commands and server connections to unknown external addresses.
