PHP Security Flaw: Which Indian Websites Are Affected?

PHP's developers released emergency fixes on October 21 for two critical flaws that can let an attacker run code on a web server without logging in. The bugs, known as 'PHP2Shell', affect software that runs a large share of the web. India's cyber agency CERT-In has also issued an alert.

Which Indian websites are affected?

CERT-In published vulnerability note CIVN-2026-0510 on October 21, rating the flaws critical and warning that exploitation could lead to code execution and system compromise. The government organisation has recommended restricted access, web application firewalls, log monitoring and backup checks.

PHP runs much of the Indian web, from WordPress sites and university and government portals to small online shops and older enterprise systems, and many depend on shared hosting. Being exposed is not the same as being hacked. There are no Indian victim names yet and there is no official figure for how many Indian sites are vulnerable. It's unclear how many sites have been breached, who is behind the attacks, or whether any Indian systems are affected.

Abroad, websites in the Netherlands, Finland, France and Denmark went offline as a precaution, and France and Australia reportedly locked down government sites.

Who is affected?

Every PHP installation that serves web requests is exposed, including PHP-FPM, Apache with mod_php (the greatest danger), php-cgi, FrankenPHP and LiteSpeed. WordPress, Drupal, Magento, Joomla and Laravel sites are at risk if they run a vulnerable PHP version. The flaw is in PHP itself, not in any plugin. The affected code dates back to PHP 5.4 from 2012, and PHP says it no longer supports versions 8.1 and earlier. PHP runs on about 70 percent of websites worldwide whose server language is known.

What happened?

The flaws are tracked as CVE-2026-109618 and CVE-2026-109619 and both are rated 9.2 on the CVSS v4.0 scale. The first stems from how PHP handles out-of-memory errors, which can leave request data partly set up. The second involves request data that survives after its memory is freed. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

What should affected websites do?

Updating is the only complete fix, according to Qualys. Companies on shared hosting should ask their provider which PHP version they run. Sites on PHP 8.1 or older have no official patch and must upgrade. Where patching is delayed, PHP suggests temporary measures, such as disabling the session upload-progress feature, but these don't make an unpatched server safe.