PHP’s developers released emergency fixes on October 21 for two critical flaws that can allow an attacker to run code on a web server without logging in. The bugs, known as “PHP2Shell”, affect software that powers a large share of the web. India’s cyber agency CERT-In has also issued an alert.
Which Indian websites are affected?
CERT-In published vulnerability note CIVN-2026-0510 on October 21, rating the flaws critical and warning that exploitation could lead to code execution and system compromise. The government organisation has recommended restricted access, web application firewalls, log monitoring and backup checks.
PHP runs a large part of the Indian web, from WordPress sites and university and government portals to small online shops and older enterprise systems, and many of them depend on shared hosting. Being exposed does not mean a site has been hacked. No Indian victims have been named so far, and there is no official figure for how many Indian sites are vulnerable. It is also unclear how many sites have been breached, who is behind the attacks, or whether any Indian systems have been affected.
Abroad, websites in the Netherlands, Finland, France and Denmark went offline as a precaution, and France and Australia have reportedly locked down government sites.
Who is affected?
Every PHP installation that serves web requests is exposed, including PHP-FPM, Apache with mod_php (which carries the greatest danger), php-cgi, FrankenPHP and LiteSpeed. Sites built on WordPress, Drupal, Magento, Joomla and Laravel are at risk if they run a vulnerable PHP version. The flaw lies in PHP itself and not in any plugin.
The affected code goes back to PHP 5.4, released in 2012, and PHP says it no longer supports versions 8.1 and earlier. PHP runs on about 70 percent of websites worldwide whose server language is known.
What happened?
The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and both are rated 9.2 on the CVSS v4.0 scale. The first stems from the way PHP handles out-of-memory errors, which can leave request data partly set up. The second involves request data that survives after its memory has been freed. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Also Read:Apple Set to Unveil First Touchscreen MacBook Pro on October 28
What should affected websites do?
According to Qualys, updating is the only complete fix. Companies on shared hosting should ask their provider which PHP version they are running. Sites on PHP 8.1 or older have no official patch and must upgrade.
Where patching is delayed, PHP suggests temporary measures, such as disabling the session upload-progress feature, but these do not make an unpatched server safe.