PHP2Shell Update: One in ten organizations impacted as Europe bears the brunt

Two critical vulnerabilities in PHP, the programming language behind a large of the world’s websites, online stores and internet services, are being actively targeted. Since details of CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell, leaked ahead of planned disclosure, 10% of organisations worldwide have been impacted (“impacted” means exploitation attempts, we have no way of knowing if the attack has been successful), according to Check Point Research. Hourly activity peaks at midnight, when fewer security teams are watching. Government institutions in the Netherlands and Finland have taken some of their websites offline as a precaution.

What PHP2Shell is and why it matters

The two vulnerabilities sit in the PHP engine itself. That puts a vast range of technology in scope: websites and online stores running WordPress, Drupal, Joomla or Magento, shared hosting platforms, cPanel and Plesk control panels, and many commercial applications. An attacker can exploit the flaws to run their own code on a vulnerable server remotely, without logging in. That can lead to data theft, attacks on other connected systems, or service outages.

Two things have made the situation more urgent. Details of the vulnerabilities leaked before the planned disclosure, which gave attackers a head start and shortened the time defenders had to prepare. And screenshots of a PHP2Shell attack tool targeting the flaws have begun to circulate, a sign that exploitation is moving from theory to practice.

Europe has been hit more than twice as hard as other regions

14% of organisations in Europe have been impacted since disclosure, more than double the 6% recorded in North America, Latin America and APAC. Africa has the lowest regional rate at 4%.

16 of the 18 most affected countries are in Europe

Hungary has the highest impact rate in the world, with 38% of organisations affected since disclosure. Denmark follows at 32% and Austria at 28%, with Sweden and Romania at 22% each. Portugal, Thailand and Serbia each recorded 17%, followed by Germany at 16% and the Netherlands at 15%. India recorded 14%, Norway and Ukraine 13%, and Czechia, Poland, Spain, Switzerland and the United Kingdom 12% each. Thailand and India are the only countries outside Europe in that group. Just behind them, Turkey recorded 11%, and Ireland, Brazil and Italy 10%.

Telecoms and education are the most exposed industries

Telecommunications recorded the highest impact rate at 20%, twice the global rate, followed by education at 18%. Media and entertainment and associations and non-profits each recorded 16%. Agriculture and transportation and logistics each recorded 14%, followed by software and healthcare and medical at 13%. Information technology recorded 12% and business services 11%.

Real estate, rentals and leasing; automotive; aerospace and defence; industrial manufacturing; and government each recorded 9%. Hardware and semiconductors, consumer goods and services, financial services, and construction and engineering each recorded 8%. Wholesale and distribution recorded 7%, while energy and utilities and hospitality, travel and recreation each recorded 6%. Biotech and pharmaceuticals recorded the lowest rate of the 23 industries tracked, at 5%.

Updating your website is not enough

Because the flaws are in PHP, updating WordPress, another content management system or its plugins does not close them. PHP has to be updated directly on the server. Fixes are available in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Version 8.1 and older remain vulnerable unless the fix is backported, which makes unsupported versions a particular concern.

“When governments are choosing to take their own websites offline rather than risk leaving them exposed, it gives you a pretty clear indication of how seriously this is being taken,” said Charlotte Wilson, Head of Enterprise at Check Point Software Technologies. “The immediate priority is getting systems updated, but the bigger question is whether we’ve become too dependent on technology that can leave so many organisations vulnerable at exactly the same time.”

What organisations should do now

Find every PHP instance. You cannot protect a system you do not know exists. Inventory PHP across your estate, including containers and third-party products.

Patch PHP on the server, starting with internet-facing systems. Move to a fixed version and pay particular attention to versions that are no longer supported.

Confirm with your hosting provider. If your website is externally hosted, ask your provider directly whether the patch has been applied.

Restart and verify. Restart the relevant services after updating and check they are actually running the patched version.

Restrict what you cannot patch quickly. Limit who can reach a vulnerable service, or take it offline temporarily until it can be secured.

Add layers of protection. Enable attack blocking, keep security protections up to date, and limit communication between web servers and the rest of the corporate network so a breach cannot spread easily. These measures buy time but do not replace updating PHP.

How to tell if you have already been targeted

Installing the patch will not remove any damage or malicious code attackers may already have left on a server. Organisations should check for signs of compromise, including:

Unexplained web service outages

New or unfamiliar PHP files appearing on websites

Unusual requests to web servers

Web server processes executing system commands

Server connections to unknown external addresses

H ow Check Point protects you

Check Point Intrusion Prevention System (IPS) protections are available

Check Point Web Application Firewall (WAF) preemptively protects against php2shell . We recommend enabling the latest signatures in Prevent mode for the best coverage and visibility

Check Point Exposure Management can assist you with mapping your PHP exposure and accelerating mitigation.

Check Point Research continues to monitor the situation and will update its analysis as new information becomes available. Read the full technical analysis here .