{"id":2901,"date":"2026-10-24T08:33:06","date_gmt":"2026-10-24T08:33:06","guid":{"rendered":"https:\/\/newsraise.com\/in\/2026\/10\/24\/critical-php-flaws-threaten-millions-web-services\/"},"modified":"2026-10-24T08:33:06","modified_gmt":"2026-10-24T08:33:06","slug":"critical-php-flaws-threaten-millions-web-services","status":"publish","type":"post","link":"https:\/\/newsraise.com\/in\/2026\/10\/24\/critical-php-flaws-threaten-millions-web-services\/","title":{"rendered":"Critical PHP Flaws Threaten Millions of Web Services"},"content":{"rendered":"\n<!-- Quick Adsense WordPress Plugin: http:\/\/quickadsense.com\/ -->\n<div class=\"9fece8afa224fd09e54b043d0febfb58\" data-index=\"1\" style=\"float: none; margin:10px 0 10px 0; text-align:center;\">\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js\"><\/script>\r\n<!-- NR ATF -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-8898941184964366\"\r\n     data-ad-slot=\"4839033563\"\r\n     data-ad-format=\"auto\"\r\n     data-full-width-responsive=\"true\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<\/div>\n<p>Two critical vulnerabilities in the PHP programming language have triggered a global cybersecurity alert, warning that attackers could execute code on vulnerable servers without any authentication. The flaws, collectively dubbed \u201cPHP2Shell,\u201d affect a broad swath of internet\u2011facing services that rely on PHP for core functionality, raising immediate concerns for businesses that depend on websites, customer portals, and other web\u2011based applications.<\/p>\n<h2>Scope of the vulnerabilities<\/h2>\n<p>PHP, a server\u2011side scripting language, underpins widely deployed platforms such as WordPress, Drupal, Joomla and Magento. The newly disclosed weaknesses allow a remote attacker to run arbitrary code simply by manipulating certain session settings while the PHP session upload progress feature remains active. Aamir Lakhani, global director of threat intelligence and adversarial artificial intelligence research at Fortinet, described the situation as an &#8220;urgent security and business continuity risk for organizations that depend on websites, customer portals, and other web applications.&#8221;<\/p>\n<p>In addition to the PHP2Shell issue, PHP issued a separate advisory on October 23 urging users to temporarily disable the session upload progress feature until the next regular bug\u2011fix release. This recommendation followed an earlier advisory on October 21 that highlighted a related vulnerability. The latest warning applies only when specific session settings are altered while the upload progress feature is enabled; users who have already disabled the feature are not required to take further action.<\/p>\n<h2>Extent of exposure worldwide<\/h2>\n<p>Research firms have quantified the potential scale of the problem. Censys, a internet\u2011wide scanning platform, recorded approximately 36.7\u202fmillion internet\u2011facing services reporting PHP versions that could be affected, based on its snapshot taken on October\u202f22. Those figures represent service counts rather than unique servers or organisations, and they may include installations already patched through vendor updates.<\/p>\n<p>Qualys, a security\u2011technology provider, reported an even larger footprint. Saeed Abbasi, head of the Threat Research Unit and director of product at Qualys, said the company identified 167\u202fmillion PHP package installations across 12,000 organisations. Of those installations, 73\u202fpercent are deployed on internet\u2011facing assets, placing them within reach of remote attackers. Abbasi warned that applying a patch alone will not be sufficient for systems running unsupported PHP versions; upgrading to a supported release is the only viable long\u2011term solution. He emphasized that &#8220;nearly all PHP installations are either vulnerable or running unsupported versions.&#8221;<\/p>\n<p>Indian internet infrastructure appears particularly exposed. CloudSEK, a security\u2011research firm, used Shodan data to locate 2.2\u202fmillion internet\u2011facing services worldwide that disclosed PHP version information. India ranked ninth globally, with 53,400 services revealing PHP details. Of the 36,700 Indian services that displayed version numbers, about 36,100 were unpatched, and 19,500 were running versions that have already reached end\u2011of\u2011life, according to Akash Karthi, a security researcher at CloudSEK.<\/p>\n<h2>Mitigation steps and challenges<\/h2>\n<p>PHP\u2019s immediate recommendation is to disable the session upload progress feature until a regular bug\u2011fix release addresses the underlying issue. The guidance applies only to installations where the feature remains enabled and specific session settings are altered during runtime. Administrators who have already turned off the feature are exempt from further action.<\/p>\n<p>Beyond the temporary disable\u2011ment, security experts stress the importance of comprehensive patch management and version upgrades. The PHP2Shell vulnerabilities affect versions that are still in widespread use, and many organisations run PHP installations that are no longer supported by the upstream project. In such cases, patching may not be possible, and a full upgrade to a supported version is required to eliminate the risk.<\/p>\n<p>Companies that rely on third\u2011party applications built on PHP\u2014such as content\u2011management systems, e\u2011commerce platforms, and custom portals\u2014must also verify that their vendors have released compatible updates. Failure to do so could leave the underlying PHP runtime exposed even if the organisation\u2019s own codebase is secure.<\/p>\n<p>The broader implication for the tech ecosystem is a reminder of the systemic risk posed by a single, widely adopted language. Because PHP powers a large proportion of the public\u2011facing web, any critical flaw can cascade across countless services, from small blogs to enterprise\u2011grade portals. The alerts issued in late October underscore the need for continuous monitoring, rapid response to vendor advisories, and proactive lifecycle management of software components.<\/p>\n<p>Stakeholders are advised to audit their PHP deployments, confirm the status of the session upload progress setting, and apply any available patches promptly. For installations that cannot be patched because they run end\u2011of\u2011life versions, organisations should prioritize migration to supported releases to restore a defensible security posture.<\/p>\n<p>As the situation evolves, security researchers and vendors are expected to provide further guidance. In the meantime, the combination of high\u2011profile advisories, extensive exposure metrics, and the potential for unauthenticated remote code execution makes the PHP2Shell vulnerabilities one of the most significant web\u2011security challenges of the year.<\/p>\n\n<div style=\"font-size: 0px; height: 0px; line-height: 0px; margin: 0; padding: 0; clear: both;\"><\/div>","protected":false},"excerpt":{"rendered":"<p>Two newly disclosed PHP vulnerabilities could let attackers execute code remotely on unprotected servers, exposing tens of millions of internet\u2011facing services worldwide.<\/p>\n","protected":false},"author":2,"featured_media":2902,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[299],"tags":[1411,3236,3235,3179,2378],"class_list":["post-2901","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news","tag-cybersecurity","tag-internet-services","tag-php-vulnerabilities","tag-software-patches","tag-web-security","entry"],"_links":{"self":[{"href":"https:\/\/newsraise.com\/in\/wp-json\/wp\/v2\/posts\/2901","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/newsraise.com\/in\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/newsraise.com\/in\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/newsraise.com\/in\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/newsraise.com\/in\/wp-json\/wp\/v2\/comments?post=2901"}],"version-history":[{"count":0,"href":"https:\/\/newsraise.com\/in\/wp-json\/wp\/v2\/posts\/2901\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/newsraise.com\/in\/wp-json\/wp\/v2\/media\/2902"}],"wp:attachment":[{"href":"https:\/\/newsraise.com\/in\/wp-json\/wp\/v2\/media?parent=2901"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/newsraise.com\/in\/wp-json\/wp\/v2\/categories?post=2901"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/newsraise.com\/in\/wp-json\/wp\/v2\/tags?post=2901"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}