Millions of Internet-Facing Services Face Potential Risk

Two critical vulnerabilities in PHP have triggered a global cybersecurity alert, raising concerns that attackers could remotely execute malicious code on vulnerable servers without authentication. The flaws, collectively referred to as PHP2Shell, could expose websites, customer portals and other online services to attacks.

The warning comes as PHP has separately urged users to temporarily disable its session upload progress feature to reduce the risk associated with another remote code execution vulnerability. The developments have increased pressure on organisations to review their software installations, apply security updates and identify systems that may no longer receive official support.

PHP issued its latest advisory on October 23, following an earlier warning on October 21. The newer issue affects applications under specific conditions involving changes to session settings while the upload progress feature remains enabled. Users who have already disabled the feature do not need to take additional action for this issue.

PHP2Shell Raises Concerns Over Widespread Exposure

PHP is a server-side programming language used to power websites and web applications across the internet. Widely deployed platforms, including WordPress, Drupal, Joomla and Magento, rely on PHP in various capacities.

That broad adoption creates a challenge for security teams. Organisations may face exposure even if their internal developers do not directly maintain PHP applications. Vulnerable components can exist within commercial software, third-party services, hosting environments and embedded systems.

Aamir Lakhani, global director of threat intelligence and adversarial artificial intelligence research at Fortinet, warned that the two vulnerabilities posed an urgent security and business continuity risk to organisations dependent on web-based services.

The primary concern is remote code execution. Depending on the affected system and its configuration, a successful attack could allow an unauthorised party to execute code on a server. The resulting impact would depend on the attacker's privileges, the application's security controls and the server's exposure.

Potential consequences include compromised applications, unauthorised access to sensitive information and disruption to online services. However, the existence of a vulnerability does not establish that a particular organisation has been breached.

Security Researchers Identify Millions of Potentially Affected Services

The reported figures suggest that the problem extends across a substantial part of the internet-facing software ecosystem.

Censys identified approximately 36.7 million internet-facing services reporting potentially affected PHP versions in its October 22 snapshot. The figure represents service observations, not unique servers or organisations. It may also include installations that have already received patches through software vendors or hosting providers.

Separate research from Qualys found 167 million PHP package installations across 12,000 organisations, with 73% deployed on internet-facing assets, according to Saeed Abbasi, head of the company's Threat Research Unit and director of product.

These figures describe different measurements and should not be treated as interchangeable. Package installations can include multiple instances within the same organisation, while internet-facing service counts do not necessarily establish that every identified system is exploitable.

Abbasi warned that applying patches alone would not resolve the problem for organisations using unsupported PHP versions. In those cases, upgrading to a supported release may be the only sustainable solution.

India Also Faces Significant Exposure

India appears among the countries with a substantial number of internet-facing services disclosing PHP information.

CloudSEK reported that Shodan identified approximately 2.2 million internet-facing services displaying PHP information worldwide. India ranked ninth, with around 53,400 services, according to the company's findings.

Akash Karthi, a security researcher at CloudSEK, said approximately 36,700 Indian services revealed their PHP versions. Of those, about 36,100 were unpatched, including 19,500 running versions that had reached end of life.

These numbers indicate potential exposure, not confirmed compromises. Publicly visible PHP information does not automatically mean an attacker can exploit a service. Actual risk depends on the precise software version, configuration, available security fixes and other protective measures.

Still, outdated installations can leave organisations with fewer options for addressing newly disclosed threats, particularly when their software has stopped receiving security updates.

Patching and Upgrading Remain the Main Defence

Security teams should first identify PHP installations across production servers, websites, hosting environments and third-party applications. They should then determine whether the affected versions are vulnerable and apply the appropriate vendor-recommended updates.

For the PHP2Shell vulnerabilities, upgrading to a patched PHP version and restarting all PHP processes is required to complete the remediation. Organisations running unsupported releases may need vendor-provided security fixes or migration to a supported version.

The separate session upload progress advisory also requires attention. Administrators should follow PHP's guidance to disable the affected feature temporarily where applicable, while recognising that this measure addresses a separate risk and does not replace patching for PHP2Shell.

The scale of the reported exposure makes timely action essential. Organisations that rely on PHP should verify their software versions, prioritise internet-facing systems and confirm that updates have taken effect. Temporary safeguards can reduce risk, but supported software and complete remediation remain the strongest defence against these vulnerabilities.