Millions of websites worldwide could be exposed to cyberattacks following the discovery of serious vulnerabilities in PHP (Hypertext Preprocessor), one of the internet’s most widely used programming languages. The risk extends to businesses, government agencies, online retailers and other organisations that rely on websites to deliver services.
PHP is a programming language that works behind the scenes to make websites function. When users log into a portal, shop online, fill out a government application or access a news website, PHP may be helping process their requests.
It also powers WordPress, the popular platform used to build and manage websites. This widespread use means that a weakness in PHP can have consequences far beyond individual websites.
The vulnerabilities, known collectively as PHP2Shell, could allow hackers to gain control of vulnerable website servers remotely.
The name combines PHP, the programming language affected, and “shell”, a term for an interface that allows commands to be issued directly to a computer. In simple terms, the flaws could give an attacker a way to run commands on an affected server without logging in through the usual process. PHP2Shell is not a virus or a separate software product, but the name given to the security threat posed by these flaws.
Depending on the server and its configuration, attackers could potentially steal sensitive information, alter website content, install malicious software or disrupt online services.
The threat is significant for India, where businesses and government departments increasingly depend on digital platforms to deliver services and handle sensitive information.
More than 50,000 internet-facing assets running PHP have been identified in India, including 159 government assets. This does not mean all of them are vulnerable or have been compromised. However, it highlights the potential scale of exposure if organisations have not updated their systems.
The vulnerability is part of a wider challenge facing organisations worldwide. Software used by millions can become a common point of attack, allowing cybercriminals to target numerous organisations by exploiting the same weakness.
The discovery also highlights the growing role of artificial intelligence in cybersecurity research, helping researchers identify software flaws that might otherwise remain undetected.
Security updates have been released to address the vulnerabilities. Organisations need to identify affected systems, install the relevant patches and check for signs of unauthorised access.
For users, the immediate concern is whether the websites they rely on are adequately protected. The responsibility for addressing the threat, however, rests largely with website owners, technology teams and service providers.
Published on October 22, 2026
