Criminal attempting to hack computer system and getting access denied. Hacker breaking into online server unsuccessfully while doing illegal activi
Center-Center-DelhiTwo critical vulnerabilities in PHP, the software used to run websites and web applications, could allow hackers to run their own code on affected servers without logging in.
The flaws could also expose passwords, security tokens and other sensitive information. The PHP development team has released security updates, while Cloudflare has reported attempts to exploit the flaws.
The vulnerabilities, named PHP2Shell and identified as CVE-2026-109618 and CVE-2026-109619, were disclosed on 21 October. Both have a severity score of 9.2 out of 10.
A study by cybersecurity company Qualys, which examined 12,000 organisations, identified 167 million PHP package installations, of which 73% were on systems accessible through the internet. Among 155 million installations with known versions, 110 million were running unsupported PHP versions, while 44 million were using supported versions that had not yet been patched.
"We found 167 million PHP package installations across 12,000 organisations, and 73% of them are on internet-facing assets, putting them within reach of remote attackers," said Saeed Abbasi, head of Qualys's Threat Research Unit and director of product.
He added: "Applying a patch alone will not be sufficient for systems running unsupported versions, where upgrading is the only viable long-term solution."
The report did not provide figures for affected systems in India.
Websites and platforms use PHP to process requests, display content and communicate with databases. When the software handles certain errors, it can mishandle parts of the computer memory it uses to process information. Attackers can send specially crafted requests to exploit these errors and potentially take control of a server.
The PHP team has released fixes for versions 8.2, 8.3, 8.4 and 8.5. However, the risk extends to websites running older PHP versions, including those that no longer receive regular security updates.
Cloudflare said it had observed attempts to exploit the vulnerabilities. The company has introduced protection for customers using its free and paid web application firewall services.
Organisations have been advised to update PHP, check systems exposed to the internet and restrict public access where updates cannot be applied immediately. The PHP team says that installing the relevant security updates is the complete fix.
