A Web Flaw Has Raised Global Alarm, Over 53,000 Indian Servers Likely At Risk

Over 53,000 servers in India run PHP, the popular programming language in which two "critical" loopholes could cause issues for websites

23 Oct 2026, 12:04 · NDTV

Show
Quick Read
Summary is AI-generated, newsroom-reviewed

Governments and businesses are urgently fixing critical PHP vulnerabilities known as PHP2Shell
PHP2Shell allows remote code execution without passwords, risking data theft and service disruption
India has over 53,000 PHP servers, including 234 government domains, potentially vulnerable to attacks

What should you do if PHP cannot be updated?
New Delhi:

Governments and businesses worldwide are racing to fix two critical flaws in PHP, a programming language used by about 7 in 10 websites, including those built with WordPress. Experts warn India could be hit even harder.

Two vulnerabilities, collectively known as "PHP2Shell", could let attackers remotely run malicious code on affected servers without needing any password or authorisation, potentially stealing data, changing websites or disrupting services.

"High Inflation Is Like Tax On Everyone": RBI Governor At NDTV World Summit

AI Agents To Outnumber Humans Soon? What Futurist Mike Walsh Told NDTV

This Delhi Boy Has 3 Michelin Stars. His Heart Still Goes To Rajindar Da Dhaba

Ashwini Vaishnaw Explains Semiconductor Complexity: 'Everything On This Tiny Nail'

Indian-Branded Mobile Phones By October 23, 2028, Says Ashwini Vaishnaw

AI Law In India Soon? What Ashwini Vaishnaw Said At NDTV World Summit

'Need To Look At Next 10 Years': Bondada Chairperson To NDTV On Solar Energy

World's 1st AI Actor Tilly Norwood Was Asked If She Knew Hindi. A Conversation Followed

AI Law In India Soon? What Ashwini Vaishnaw Said At NDTV World Summit

Iran's Supreme Leader's Representative Says India Can Play 'Big Role' In Middle East Peace

The issue was so critical that Japan's prime minister had to post on X about it, and many European sites took themselves down temporarily as a precaution so that attackers could not exploit those vulnerabilities before they were patched by security updates released by the PHP development team on October 21.

India's cybersecurity watchdog CERT-In rated vulnerabilities as "critical" and recommended an "urgent" fix.

"What makes PHP2Shell particularly serious is that it sits in the underlying PHP engine. So no matter how securely you've built your website, it could still be exposed if it's running an affected PHP version. An attacker may not even need to log in to exploit it," says Aseem Shrey, a cybersecurity expert.

The risk depends on how PHP is deployed, but its developers have urged all users serving web requests to update immediately.

Why Experts Are Concerned About India

A scan on Shodan, a search engine for internet infrastructure, returned 53,019 results identifying PHP on servers located in India, including 234 associated with government domains ending in ".gov.in", as of October 22, 2026.

These numbers are likely higher because not all systems disclose the programming language they run, and a single server can host multiple websites. The results indicate PHP use but do not, by themselves, confirm that every system remains vulnerable.

Experts say organisations with older websites, limited technical support or unclear maintenance arrangements could struggle to respond quickly. Smaller businesses and public institutions that depend on external providers may face particular challenges.

"Think about how businesses get a website built. They go to an IT provider, get a WordPress site set up with a few pages and a form to collect customer enquiries, and start using it. They may not even know that PHP is running underneath. That's why the potential impact extends beyond technology companies to everyday businesses," Shrey says.

For such businesses, a compromised website could expose customer enquiries and other information, interrupt services or allow attackers to change what visitors see.

"Awareness is a major issue in our country. So many organisations have yet to fix many vulnerabilities flagged by CERT-IN in the past," says Prateek Dubey, a cybersecurity expert.

Organisations with dedicated security teams may be better equipped to respond quickly. But universities, agricultural institutes and government departments with limited technical resources may need more time to identify affected systems and coordinate updates. They may face attacks before they could fix the issue.

Older Websites May Be Harder To Update

According to web technology survey platform W3Techs, around 15 per cent of PHP websites still use older versions that no longer receive security updates from the PHP project. Although hosting providers, Linux distributors and commercial vendors may supply fixes. Organisations without access to those fixes may need to move to a supported version.

That can involve more than installing an update.

"There are certain application areas which may break if they upgrade PHP, because in some cases you need to upgrade the code also when you upgrade the versions," says Sachin, the director of Gurugram-based cybersecurity company eSecForte.

Thousands of private and government websites, including those of Kerala Police, FSSAI, Bhubaneswar Smart City and the Indian Railways Institute of Financial Management, and the West Bengal Health Department, are running older PHP versions in full or in part, Shodan records indicate. It's not clear how many of them have already applied the security fix.

"My bigger concern is who handles updates after the website goes live. If the business assumes the agency or hosting provider is taking care of it, some websites could stay unpatched for months. Updating WordPress or its plugins alone won't fix this. PHP itself needs to be patched," Shrey says.

Businesses should ask whoever manages their website or hosting to confirm that the PHP security fixes have been applied and the affected services restarted.

Patching Just Part Of Response

Organisations also need to consider whether attackers accessed their systems before the update.

"It's not just about fixing the vulnerability. Organisations also need to find out whether they lost any data in any attack before they could patch their systems," Dubey told NDTV Datafy, warning that many Indian companies and government departments might be ill-prepared to tackle security scenarios where time is key.

Amazon's threat intelligence team reported detecting PHP2Shell exploitation attempts as early as October 17, four days before public disclosure.

Cloudflare, an internet security company, said it recorded thousands of exploit attempts across the network in the 10 hours before the loopholes were revealed publicly. "That jumped to tens of thousands in the 45 minutes post-announcement, hundreds of thousands within 2 hours, and millions now," Matthew Prince, the CEO of internet security company Cloudflare, said on October 22.

Got a follow‑up question on this article? Go on

How may i help you today

Show full article

Track Latest News Live on NDTV.com and get news updates from India and around the world