The vulnerability, which has been assigned a severity rating of 9.2, could have far-reaching consequences because of PHP’s extensive use across millions of web servers worldwide. Its applications span content management systems, including WordPress, web applications and numerous backend services that support digital operations across the internet.
Sergey Lozhkin, Head of the Research Center for APAC and META at Kaspersky’s Global Research and Analysis Team (GReAT), described the development as a major cybersecurity incident, warning that the flaw could become one of the most significant vulnerabilities of 2026.
According to Lozhkin, successful exploitation could allow attackers to execute malicious code remotely on affected systems, potentially opening the door to serious compromises of server security.
“In practical terms, attackers could potentially execute malicious code on affected systems, including the deployment of web shells, thereby gaining control over vulnerable servers,” he said.
Remote code execution is considered one of the most serious categories of cybersecurity vulnerabilities because it can enable threat actors to run unauthorised commands or programs on compromised systems. The deployment of web shells could further strengthen attackers’ access, allowing them to maintain control over affected servers and potentially facilitate additional malicious activities.
The widespread adoption of PHP also raises the possibility that exploitation could have consequences beyond individual organisations. Websites, online services and backend systems that depend on vulnerable PHP installations could face increased exposure if the flaw is exploited before adequate security measures are implemented.
Lozhkin warned that incidents involving widely deployed technologies can spread rapidly across the global cyber landscape, making a swift and coordinated response essential.
“Incidents of this kind can escalate rapidly across the global cyber landscape, particularly when they involve technologies that are so widely deployed,” he said.
He urged organisations whose infrastructure relies on PHP to prioritise remediation and apply the relevant security patch without delay, stressing that prompt action would be crucial to limiting exposure and safeguarding critical systems.
“For that reason, the response must be immediate and decisive. If your infrastructure depends on PHP, the patch should be applied as soon as possible, as prompt remediation will be essential to minimising exposure and protecting critical systems,” Lozhkin said.
Organisations and system administrators are therefore encouraged to review their PHP deployments, identify potentially affected systems and follow the appropriate security guidance to address the vulnerability.
Further technical details and security guidance are available through Kaspersky’s Securelist publication at https://securelist.com/tr/php2shell-critical-vulnerabilities-in-php/121596/.