India is among the countries facing significant exposure to the latest PHP2Shell cyberattack campaign, according to a report by Check Point Research published on October 22, 2026. The report found that 14% of organisations monitored in India had faced attempts to exploit the vulnerabilities, placing the country 11th globally and above the worldwide average of 10%.
The findings have raised concerns for Indian businesses, website administrators and telecommunications companies that rely on PHP-based systems. The vulnerabilities could allow attackers to execute malicious commands on affected servers, potentially exposing sensitive information or disrupting online services.
Check Point reported that details of the security flaws became available before their planned disclosure, giving attackers an opportunity to target systems that had not yet been updated.
What Is PHP2Shell and Why Is It a Security Risk?
PHP2Shell refers to two reported security vulnerabilities identified by the codes CVE-2026-109618 and CVE-2026-109619. PHP is widely used to power websites and online services, including sites built with content management and e-commerce platforms such as WordPress, Drupal, Joomla and Magento.
If a vulnerable server remains unpatched, attackers may be able to exploit the flaws to execute unauthorised commands without requiring a password. Depending on the affected system and its configuration, this could expose stored information, compromise server operations or interrupt services.
For example, a vulnerable online shopping website could face attempts to access its server or obtain sensitive data.
However, the report measures attempted exploitation, not confirmed successful intrusions. An organisation recorded as facing an attack attempt has not necessarily suffered a successful breach.
India Among the 11th Most Affected Countries
Check Point Research reported varying levels of exposure across countries, with several European nations recording higher percentages of organisations facing exploitation attempts.
The reported figures are as follows:
| Country | Organisations facing exploitation attempts |
|---|---|
| Hungary | 38% |
| Denmark | 32% |
| Austria | 28% |
| Sweden and Romania | 22% |
| Thailand | 17% |
| Germany | 16% |
| Netherlands | 15% |
| India | 14% |
| Global average | 10% |
Europe recorded the highest regional impact, with 14% of monitored organisations facing attack attempts. India and Thailand were the only countries outside Europe among the 18 most affected nations identified in the report.
The telecommunications industry recorded the highest sector-level exposure at 20%. Education followed at 18%, while media and entertainment organisations recorded 16%.
These figures underline the importance of checking vulnerable systems, particularly in sectors that depend heavily on online infrastructure.
Why Updating WordPress Alone May Not Be Enough
The reported flaws affect PHP itself, rather than being limited to a particular website platform. As a result, updating WordPress or another content management system alone may not resolve the underlying vulnerability if the server continues to run an affected PHP version.
Check Point executive Charlotte Wilson highlighted the need for both immediate security updates and a broader review of technology risks.
Security fixes are listed for PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Organisations using older or affected versions should check the relevant vendor guidance and upgrade to an appropriate patched release.
Website owners and system administrators should also review server logs for suspicious activity, look for unfamiliar files and confirm with their hosting providers that the necessary security updates have been installed.
What Businesses and Website Owners Should Do
Organisations should identify which PHP versions are running across their websites and servers, determine whether their systems are affected and apply the relevant security fixes. They should also investigate unusual server activity and follow advice from their hosting providers and security teams.
Businesses using WordPress, Drupal, Joomla, Magento or other PHP-based platforms should not assume that updating the website software automatically resolves vulnerabilities in the underlying server environment.
Prompt patching and careful monitoring can help reduce exposure, although the appropriate response will depend on each organisation’s infrastructure and security requirements.
Disclaimer
This article is intended for general informational purposes only and is based on the findings attributed to Check Point Research, dated October 22, 2026. The reported percentages refer to organisations facing exploitation attempts and do not establish that every affected organisation experienced a successful breach. Vulnerability details, affected software versions and security recommendations may change as further information becomes available. Organisations should consult official PHP security advisories, Check Point Research and their software or hosting providers before taking action. This article is not a substitute for professional cybersecurity advice.