Critical ‘PHP2Shell’ Flaws Put Millions of Websites at Risk, CERT-India Urges Urgent Update

Critical ‘PHP2Shell’ Flaws Put Millions of Websites at Risk, CERT-India Urges Urgent Update

NEW DELHI, October 23, 2026 [VoM News]: Two critical security vulnerabilities affecting PHP, the programming language powering a large share of websites worldwide, have triggered urgent warnings as experts caution that Indian websites could face significant exposure.

The vulnerabilities, collectively referred to as “PHP2Shell”, could potentially allow attackers to remotely execute malicious code on vulnerable servers without authentication, putting website data and services at risk.

India’s cybersecurity agency CERT-In has classified the vulnerabilities as critical and recommended urgent remediation. The PHP development team released security updates on October 21 and advised users running affected systems that serve web requests to update immediately.

Cybersecurity experts said the concern extends beyond technology companies because PHP forms the underlying infrastructure for many WordPress websites.

A Shodan search reportedly identified more than 53,000 servers in India using PHP as of October 22, including hundreds associated with government domains. However, the results do not establish that all identified systems are vulnerable.

Experts warned that older websites and organisations relying on external IT providers could take longer to apply fixes, increasing potential exposure.

They stressed that updating WordPress or its plugins alone would not address vulnerabilities in the underlying PHP installation.

Website owners have been advised to contact their hosting providers or administrators to confirm that the latest PHP security fixes have been installed and affected services properly restarted.

About the Author

Dil Bar Irshad

Owner/Editor_In_Chief

Dil Bar Irshad is an Indian journalist, writer, and media entrepreneur from the Marmat area of Doda in Jammu and Kashmir, India. He is best known as the founder and Editor-in-Chief of VoM News ("Voice of Masses"), a digital news portal dedicated to highlighting public grievances and citizen issues. Career Overview • Early Career (2015–2016): He began his reporting career focusing on local public issues and citizen grievances in Jammu and Kashmir. • Regional & National Journalism: Over the years, he served as a District Correspondent for the English newspaper Khalsa Express News (2019–2020) and worked as an Urdu correspondent for Sada e Kohistan. He also reported as a J&K Correspondent for the Millennium Post. • International Reporting: In 2023, he expanded into international journalism, working as an India Correspondent for global agencies like BNN Breaking and later TrimFeed, covering diverse topics ranging from stock market updates to regional and global geopolitical developments. • Media Associations: He is an active member of the All India Media Association. Seen IN: Editor-in-Chief, VoM News India, Jammu and Kashmīr Business and Finance, Crime and Justice, Environment As seen in: VoM News, MSN, MSN India, MSN Singapore, MSN UK, Youth Ki Awaaz, Millennium Post, AgroPages, The California Courier, Hecho En California, Justice News, The Chenab Times, Niguro, Sisnoo