{"id":21,"date":"2026-10-23T12:25:12","date_gmt":"2026-10-23T10:25:12","guid":{"rendered":"https:\/\/mspbusiness.com\/en\/it-news\/ten-per-cent-of-organisations-worldwide-targeted-by-php2shell-attacks\/"},"modified":"2026-10-24T22:11:02","modified_gmt":"2026-10-24T20:11:02","slug":"ten-per-cent-of-organisations-worldwide-targeted-by-php2shell-attacks","status":"publish","type":"post","link":"https:\/\/mspbusiness.com\/en\/security\/ten-per-cent-of-organisations-worldwide-targeted-by-php2shell-attacks\/","title":{"rendered":"Ten per cent of organisations worldwide targeted by PHP2Shell attacks"},"content":{"rendered":"

Two vulnerabilities in PHP, jointly known as PHP2Shell, have been actively exploited since details leaked ahead of the planned disclosure. Attack attempts have been observed at 10% of organisations worldwide. Europe scores more than twice as high as other regions, with the Netherlands at 15%. Government bodies in the Netherlands and Finland took websites offline as a precaution.<\/strong><\/p>\n

The vulnerabilities in question are CVE-2026-109618 and CVE-2026-109619. The figures come from Check Point Research, which has been counting attack attempts since the details emerged. The researchers stress that ‘affected’ here refers to exploitation attempts. Whether an attack actually succeeded cannot be determined from the data. Hourly activity peaks around midnight, a time when fewer security teams are watching. Check Point Research sets out the technical details in a technical analysis of PHP2Shell<\/a>.<\/p>\n

Vulnerabilities in the PHP engine<\/h3>\n

The two flaws are in the PHP engine itself. That puts a large share of web traffic within reach: websites and online shops running on WordPress, Drupal, Joomla or Magento, shared hosting platforms, the cPanel and Plesk control panels and many commercial applications. An attacker can remotely execute their own code on a vulnerable server without logging in. This can lead to data theft, attacks on connected systems or service outages.<\/p>\n

Because the details leaked prematurely, attackers gained a head start and administrators had less time to prepare. Screenshots of an attack tool that exploits the vulnerabilities are now also circulating.<\/p>\n

Europe and telecoms targeted more often<\/h3>\n

In Europe, attempts have been observed at 14% of organisations, compared with 6% in North America, Latin America and APAC. Africa comes in at 4%. Of the eighteen hardest-hit countries, sixteen are in Europe. Hungary tops the list at 38%, followed by Denmark (32%), Austria (28%) and Sweden and Romania (both 22%). Germany comes in at 16%, the Netherlands at 15%.<\/p>\n

By sector, telecommunications scores highest at 20%, followed by education at 18%. Media and entertainment and non-profit organisations stand at 16%. The IT sector comes in at 12%, business services at 11% and government at 9%. Biotech and pharmaceuticals score lowest of the 23 sectors examined, at 5%.<\/p>\n

CMS update does not close the vulnerabilities<\/h3>\n

Because the flaw lies in PHP, updating WordPress, another CMS or plugins does not fix the problem. PHP must be updated directly on the server. Patches are available in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Version 8.1 and older remain vulnerable until the fix is backported.<\/p>\n

Charlotte Wilson, Head of Enterprise at Check Point Software Technologies, sees the taking offline of government websites as a sign of how seriously the situation is being taken. According to Wilson, updating systems is now the priority, but the incident also raises the question of whether organisations have become too dependent on technology that leaves many vulnerable at the same time.<\/p>\n

Recommended measures<\/h3>\n

Check Point Research advises first mapping all PHP instances, including containers and third-party products. Then patch, starting with systems that are reachable from the internet. If a website is hosted by an external provider, check whether the patch has been applied. After the update, restart the relevant services and verify that the patched version is actually running. Anything that cannot be patched quickly can be shielded or temporarily taken offline. Segmentation between web servers and the corporate network limits the spread in the event of a breach, but is no substitute for the update.<\/p>\n

A patch does not remove malicious code that has already been left on a server. Signs of compromise include unexplained outages of web services, new or unknown PHP files, anomalous requests to web servers, web server processes executing system commands and connections to unknown external addresses.<\/p>\n

Check Point also reports that it has released signatures for its IPS and Web Application Firewall, and that Exposure Management can help map PHP exposure.<\/p>\n

The full report is available via the technical analysis of PHP2Shell<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

Since the PHP2Shell vulnerabilities leaked, Check Point Research has seen attack attempts at 10% of organisations worldwide. A CMS update won’t suffice; PHP must be patched server-side.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"mspb_bron_id":1169391,"mspb_url_nl":"https:\/\/mspbusiness.com\/security-en-privacy\/tien-procent-van-organisaties-wereldwijd-doelwit-van-php2shell-aanvallen\/","mspb_url_de":"https:\/\/mspbusiness.com\/de\/security\/zehn-prozent-der-organisationen-weltweit-im-visier-von-php2shell-angriffen\/","mspb_url_en":"","mspb_beeld_url":"https:\/\/mspbusiness.com\/wp-content\/uploads\/2026\/10\/hero-1792751099755-1024x576.png","mspb_beeld_klein":"https:\/\/mspbusiness.com\/wp-content\/uploads\/2026\/10\/hero-1792751099755-400x225.png","mspb_auteur":"Redactie","mspb_beeld_alt":"","mspb_video":"","_yoast_wpseo_metadesc":"Check Point Research sees PHP2Shell attack attempts at 10% of organisations, with Europe and the Netherlands above the global average.","footnotes":""},"categories":[3],"tags":[],"layout":[6],"class_list":["post-21","post","type-post","status-publish","format-standard","hentry","category-security","layout-news"],"_links":{"self":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/21","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/comments?post=21"}],"version-history":[{"count":1,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/21\/revisions"}],"predecessor-version":[{"id":22,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/21\/revisions\/22"}],"wp:attachment":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/media?parent=21"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/categories?post=21"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/tags?post=21"},{"taxonomy":"layout","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/layout?post=21"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}