PHP2Shell Exploit Attempts Reach 22% of Swedish Organisations

Executive Summary

PHP2Shell exploit attempts have reached 22% of organisations in Sweden since details of the two critical PHP flaws leaked on 20 October 2026, Check Point Research said on 22 October. Denmark stands at 32% and Norway at 13%. Europe as a whole sits at 14% against 10% worldwide. The figures count attempts, not confirmed breaches. The flaws, CVE-2026-109618 and CVE-2026-109619, let attackers run code on web servers without logging in. Fixes exist only for PHP 8.2 and newer. The US Cybersecurity and Infrastructure Security Agency (CISA) has told organisations still on PHP 8.1 or older to take those systems offline. Swedish web host Oderland has patched its shared servers with a version-number catch for anyone checking their own.

PHP2Shell Exploit Attempts by Country and Sector

Hungary tops Check Point’s country ranking at 38%, ahead of Denmark at 32% and Austria at 28%. Sweden and Romania follow at 22% each. Sixteen of the 18 most affected countries are European; Thailand and India are the exceptions. Among the 23 industries Check Point tracks, telecommunications leads at 20% and education is next at 18% while government sits at 9%, financial services at 8% and energy and utilities at 6%. Hourly activity peaks at midnight.

Check Point counts an organisation as impacted when it sees PHP2Shell exploit attempts against it. It says it has no way of knowing whether those attempts succeeded. It hasn’t explained why Denmark and Sweden rank so high and gives no figure for Finland.

Charlotte Wilson, head of enterprise at Check Point, said the bigger question was “whether we’ve become too dependent on technology” that can expose so many organisations at once. The government site shutdowns that followed the leak are covered in our earlier report.

884,000 Servers Sit Outside the Official Fix

PHP’s emergency releases cover only its supported branches, 8.2 to 8.5. Branch 8.1 reached end of life on 31 December 2025. For 7.4, 8.0 and 8.1 the PHP security team has published only minimal source backports for people who build PHP themselves, vulnerability scanning firm Greenbone reported. Threat intelligence company Mallory counted roughly 884,000 internet-facing hosts advertising PHP 8.1 or older on Shodan on 20 October, about 59% of the 1.5 million that reported a version. Another 740,000 showed no version at all. Check Point which cited the count in its technical analysis, stresses that these are banner counts and not confirmed vulnerable systems.

CISA’s alert of 21 October goes further than most agencies. Organisations that still run PHP 8.1 or earlier should take PHP-based systems offline until they are patched, it said. The same applies to anyone who can’t update at once. CISA also warned that PHP often runs inside other software where it isn’t visible. Servers on the fixed releases in branches 8.2 to 8.5 are out of scope. Neither CVE was in CISA’s Known Exploited Vulnerabilities catalogue on 22 October, Greenbone said.

A Swedish Host Patched Every Version Back to PHP 5.2

Gothenburg-based web host Oderland posted at 04:05 on 22 October that every PHP version on its shared hosting, Agency services and Managed Servers had been updated. The packages came from its operating system supplier CloudLinux and cover PHP 5.2 to 8.5.

There is a catch.

Because CloudLinux backported the fix, PHP 8.2 on those servers reports version 8.2.34 instead of 8.2.35, Oderland said. Customers on Oderland Cloud have to patch their own servers. While it waited for packages, the company ran ModSecurity rules through Imunify360 and switched off PHP’s session.upload_progress setting on every server which it said partly mitigates the flaws.

In Stockholm, Johan Ahlmark of the National Defence Radio Establishment (FRA) described the event as more serious than average, according to a published report.

When 8.2.34 No Longer Proves Anything

Check Point’s own advice is to restart services and confirm they run the patched version. On backported builds that check misleads. A patched Oderland server on PHP 8.2 reports 8.2.34, the version Check Point listed as current for that branch before the fix. Banner-based scans including the Shodan counts behind the 884,000 figure, can’t tell the two apart either. With PHP2Shell exploit attempts already reaching 22% of Swedish organisations, proof of a fix should come from the host’s written confirmation or the package changelog.

References

1. PHP2Shell Update: One in ten organizations impacted as Europe bears the brunt
2. PHP2Shell: Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)
3. Critical Vulnerabilities in PHP Require Immediate Patching
4. Information om php2shell (CVE-2026-109618 & CVE-2026-109619)
5. PHP2Shell Remote Code Execution: Patch PHP Today
6. Published report

This post is also available in: