PHP2Shell Explained: Web Security Flaws, AI and India’s Cyber Preparedness

Server-side language: PHP stands for “PHP: Hypertext Preprocessor”. It is an open-source scripting language widely used for web development. Server-side means its code normally runs on the website’s server, rather than in the visitor’s browser.

Request processing: When a visitor opens a page or submits a form, the server receives a request. PHP can process the input, interact with a database and produce a response for the browser. Its runtime is the software that executes PHP code. WordPress is an application platform that depends on this underlying runtime.

Open-source meaning: Source code can be inspected, used, modified and redistributed under the applicable licence. Open-source software retains licence conditions and copyright; openness neither guarantees security nor makes software inherently unsafe.

Core development: PHP released emergency fixes on 21 October for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The collective label PHP2Shell refers to these flaws, rather than a separate virus. The weaknesses are in PHP’s core request-handling machinery, so applications can be exposed even without a corresponding flaw in their own code.

Precautionary response: Government and commercial services temporarily took affected systems offline while arranging protection. CERT-EU advised immediate patching and consideration of isolation from public networks where this was not feasible. A precautionary shutdown by itself does not establish that attackers breached that service.

Evidence of attacks: CERT-In’s 22 October alert reported exploitation in the wild and urged urgent updates. However, vulnerability exposure, attack attempts, successful compromise and confirmed data theft are different findings; they should not be treated as interchangeable.

Memory handling: A running programme uses working memory to process requests. PHP2Shell concerns failures in managing that memory and the internal information associated with requests.

Memory-safety failure: Accessing memory after it has been released is called use-after-free. A worker, the server process handling requests, must correctly reset request-related state. These flaws can enable code execution; researchers also demonstrated memory disclosure. Ordinary memory exhaustion does not automatically produce these outcomes: the unsafe handling is crucial.

Remote code execution: Unauthenticated remote code execution means an attacker may cause vulnerable server software to run attacker-chosen code over a network without first logging into the application. In demonstrated attack paths, PHP processes the dangerous request before application code runs, so a website login screen alone cannot prevent the attack.

Extent of control: Damage depends on the affected process’s permissions and its access to files, databases and other systems. Running code as a web-service account is not automatically the same as obtaining unrestricted administrator privileges. Limiting permissions therefore remains useful.

Vulnerability versus exploit: A vulnerability is an exploitable weakness. An exploit is a method or code that takes advantage of it. Finding a weakness and demonstrating its exploitation are related but distinct tasks.

CVE identifier: Common Vulnerabilities and Exposures provides standard identifiers for publicly disclosed vulnerabilities, allowing researchers, vendors and administrators to refer to the same issue. A CVE number identifies a vulnerability; it does not measure severity.

CVSS score: The Common Vulnerability Scoring System describes severity using a numerical score. Both PHP2Shell flaws were rated 9.2 under CVSS v4.0 and classified as critical. This is not a 92% probability of being hacked; actual risk also depends on exposure and deployed protections.

Related term: A zero-day attack exploits a previously unknown vulnerability. It should be distinguished from an attack on a publicly known flaw that an organisation has left unpatched.

Security objectives: The CIA triad explains three core information-security goals. Here, CIA means confidentiality, integrity and availability.

Governance trade-off: Temporary isolation reduces availability to protect systems and data. Administrators must restore services after verified remediation and provide alternative access where interruptions affect essential services.

Shared dependency: Many unrelated services use the same runtime. W3Techs recorded PHP on 69.3% of websites whose server-side programming language it could identify on 23 October. This is a usage estimate with a specific denominator, not a count of hacked websites. [7]

Updating the correct layer: Updating WordPress, a theme or a plugin alone does not repair a vulnerable PHP runtime. Where hosting providers manage PHP, their deployment of the runtime fix is necessary. Other products can also contain PHP internally, making exposure harder to identify.

Legacy systems: Older applications may depend on outdated software and require compatibility testing before migration. End-of-life means the original project no longer routinely supports that branch. Some vendors backport fixes, applying security corrections to older branches; protection must be verified against the vendor’s advisory rather than inferred from a version label alone.

Component visibility: A Software Bill of Materials (SBOM) records the components and dependencies making up software. Combined with an inventory of actual deployments, it helps organisations identify affected systems. An SBOM supports risk management; remediation still requires action.

Defensive use: Wiz and other participating researchers used AI-assisted analysis to identify weaknesses, demonstrate their impact and support remediation. The PHP Foundation explains that signs of the out-of-memory problem had emerged during earlier security work in 2024, while later reports established practical routes to severe consequences. AI-assisted discovery did not mean the flawed code had just been introduced.

Dual-use capability: The same ability to understand complex code can help defenders find bugs and help attackers develop or adapt exploits. Human validation, authorised testing and responsible handling of findings remain necessary.

Coordinated disclosure: Researchers, maintainers and vendors coordinate reporting, fixes and public guidance so users can obtain protection. Premature disclosure can shorten defenders’ preparation time; unresolved delays can also prolong exposure. The aim is timely protection with clear accountability.

Open-source sustainability: The PHP Foundation acknowledged that limited specialist resources, difficult compatibility choices and decision-making problems delayed earlier work. The policy lesson is to fund security maintenance and audits of widely used software, alongside discovering new vulnerabilities.

Patch: A patch changes the affected software to correct the flaw. PHP’s official guidance treats updating as the complete solution for these vulnerabilities. Administrators must verify that the corrected runtime is actually running across affected systems.

Mitigation: A mitigation reduces exposure or blocks some attack paths while a fix is arranged. A web application firewall (WAF) filters incoming web requests. It can offer temporary protection but does not repair PHP’s underlying code; the official advisory warns that partial measures do not make an installation fully safe.

Impact reduction: Least privilege gives each account or process only the permissions needed for its task. Network segmentation separates systems to limit the spread of compromise. These controls complement patching.

Recovery and investigation: Backups support restoration after disruption, while logs help investigators establish what occurred. If compromise is suspected, applying a patch alone does not establish that the system is clean; investigation and recovery may also be required.

Institutional responsibilities:

Critical infrastructure: The IT Act’s concept concerns computer resources whose incapacitation or destruction could seriously harm national security, the economy, public health or safety. The importance of a website alone does not automatically establish this legal status.

Incident reporting: CERT-In’s directions require covered entities to report specified cyber incidents within 6 hours of noticing them or being informed of them. They also require secure retention of ICT logs for a rolling 180 days within Indian jurisdiction. The six-hour rule concerns reportable incidents, rather than a universal deadline for fixing every vulnerability.

Public-service implications: Compromised or unavailable portals can interrupt applications, payments and access to records. Outsourcing hosting or software maintenance makes clear responsibilities essential: public authorities need visibility into their dependencies, evidence of remediation and workable continuity plans. Cyber preparedness is therefore a governance and procurement responsibility as well as a technical function.