New Delhi:
Governments and businesses worldwide are racing to fix two critical flaws in PHP, a programming language used by about 7 in 10 websites, including those built with WordPress. Experts warn India could be hit even harder.
Two vulnerabilities, collectively known as "PHP2Shell", could let attackers remotely run malicious code on affected servers without needing any password or authorisation, potentially stealing data, changing websites or disrupting services.
The issue was so critical that Japan's prime minister had to post on X about it, and many European sites took themselves down temporarily as a precaution so that attackers could not exploit those vulnerabilities before they were patched by security updates released by the PHP development team on October 21.
India's cybersecurity watchdog CERT-In rated vulnerabilities as "critical" and recommended an "urgent" fix.
"What makes PHP2Shell particularly serious is that it sits in the underlying PHP engine. So no matter how securely you've built your website, it could still be exposed if it's running an affected PHP version. An attacker may not even need to log in to exploit it," says Aseem Shrey, a cybersecurity expert.
The risk depends on how PHP is deployed, but its developers have urged all users serving web requests to update immediately.
Why Experts Are Concerned About India
A scan on Shodan, a search engine for internet infrastructure, returned 53,019 results identifying PHP on servers located in India, including 234 associated with government domains ending in ".gov.in", as of October 22, 2026.
These numbers are likely higher because not all systems disclose the programming language they run, and a single server can host multiple websites. The results indicate PHP use but do not, by themselves, confirm that every system remains vulnerable.
Experts say organisations with older websites, limited technical support or unclear maintenance arrangements could struggle to respond quickly. Smaller businesses and public institutions that depend on external providers may face particular challenges.
"Think about how businesses get a website built. They go to an IT provider, get a WordPress site set up with a few pages and a form to collect customer enquiries, and start using it. They may not even know that PHP is running underneath. That's why the potential impact extends beyond technology companies to everyday businesses," Shrey says.
For such businesses, a compromised website could expose customer enquiries and other information, interrupt services or allow attackers to change what visitors see.
"Awareness is a major issue in our country. So many organisations have yet to fix many vulnerabilities flagged by CERT-IN in the past," says Prateek Dubey, a cybersecurity expert.
Organisations with dedicated security teams may be better equipped to respond quickly. But universities, agricultural institutes and government departments with limited technical resources may need more time to identify affected systems and coordinate updates. They may face attacks before they could fix the issue.
Older Websites May Be Harder To Update
According to web technology survey platform W3Techs, around 15 per cent of PHP websites still use older versions that no longer receive security updates from the PHP project. Although hosting providers, Linux distributors and commercial vendors may supply fixes. Organisations without access to those fixes may need to move to a supported version.
That can involve more than installing an update.
"There are certain application areas which may break if they upgrade PHP, because in some cases you need to upgrade the code also when you upgrade the versions," says Sachin, the director of Gurugram-based cybersecurity company eSecForte.
Thousands of private and government websites, including those of Kerala Police, FSSAI, Bhubaneswar Smart City and the Indian Railways Institute of Financial Management, and the West Bengal Health Department, are running older PHP versions in full or in part, Shodan records indicate. It's not clear how many of them have already applied the security fix.
"My bigger concern is who handles updates after the website goes live. If the business assumes the agency or hosting provider is taking care of it, some websites could stay unpatched for months. Updating WordPress or its plugins alone won't fix this. PHP itself needs to be patched," Shrey says.
Businesses should ask whoever manages their website or hosting to confirm that the PHP security fixes have been applied and the affected services restarted.
Patching Just Part Of Response
Organisations also need to consider whether attackers accessed their systems before the update.
"It's not just about fixing the vulnerability. Organisations also need to find out whether they lost any data in any attack before they could patch their systems," Dubey told NDTV Datafy, warning that many Indian companies and government departments might be ill-prepared to tackle security scenarios where time is key.
Amazon's threat intelligence team reported detecting PHP2Shell exploitation attempts as early as October 17, four days before public disclosure.
Cloudflare, an internet security company, said it recorded thousands of exploit attempts across the network in the 10 hours before the loopholes were revealed publicly. "That jumped to tens of thousands in the 45 minutes post-announcement, hundreds of thousands within 2 hours, and millions now," Matthew Prince, the CEO of internet security company Cloudflare, said on October 22.