PHP2Shell: 4,691 UAE Hosts May Face Exposure

Censys estimates that 4,691 internet-facing hosts in the UAE may be exposed to PHP2Shell, equal to 79.5 per cent of the country's versioned hosts. Companies and hosting providers are deploying patched PHP packages, updating shared-hosting environments and telling customers to check runtime versions and restart web services. The risk sits inside widely used software, while the work of finding every vulnerable installation falls to organizations and their administrators.

A flaw with a wide reach

The UAE ranked 71st among 233 countries and territories observed by Censys. Pushkar Singh, regional head for Middle East and Africa at Protectt.ai, said the response showed the UAE was at the forefront of proactive threat response and digital resilience. He described cybersecurity as “not a one-time compliance exercise” but ongoing operational work requiring timely vulnerability patching, runtime protection, threat intelligence and coordinated response.

Singh said some estimates suggest three in four websites use PHP, and said it was fair to infer that most UAE enterprise websites were affected. The severity for an individual site depends on its patching status, whether the application is internal or external, and how PHP is used.

The US National Security Agency urged organizations to take websites offline if they couldn't immediately fix the two flaws. The agency said the vulnerabilities often give attackers a direct path to a server's file system or database. Tenable Research classified them as a “Vulnerability of Concern,” the highest level under its Vulnerability Watch program.

Satnam Narang, Senior Staff Research Engineer at Tenable, said nearly 70 per cent of websites with a known server-side language run PHP. The flaws are in PHP itself, putting every installation that handles web requests at risk. Exploitation can allow unauthenticated remote code execution, and one flaw can also leak memory. “They are among the most consequential vulnerabilities since Log4Shell because of their reach and scope,” Narang said. AI assistance was used to discover them.

The long tail of patching

Gavin Millard, Vice President of Intelligence at Tenable, said PHP2Shell had remained for more than a decade in code running roughly seven in ten websites. It was found in August and disclosed this week, he said, with exploitation attempts seen within hours. “What we're seeing is attackers compare old code with the new and then work backward. AI makes that quick. Speed and exploitability matter more than severity now,” Millard said.

The route to a fix depends on how organizations run PHP. Linux distributions and long-term support vendors received advance notice, allowing updated packages to arrive within hours to days. Less mainstream package sources may take days. The PHP project said the volunteer-maintained remirepo wouldn't have updates on release day. Systems running end-of-life PHP versions could wait weeks or months for a patch, or might never receive one.

Products that bundle PHP form “the long tail,” because organizations must wait for vendors to ship updates. Cloud-hosted systems are generally patched more readily, while self-hosted and on-premises applications require administrators to schedule fixes. The timeline, in other words, depends not just on the flaw but on who maintains each system and whether anyone has kept track of it.

What organizations can see—and miss

Meriam ElOuazzani, Vice President for Middle East, Turkey, and Africa at Censys, said organizations should identify affected PHP installations, apply security updates, confirm remediation and investigate unusual activity, including on legacy systems that may be harder to patch. “Without knowing what's out there, organisations cannot identify vulnerabilities until attacks occur,” she said.

Millard pointed to forgotten servers as a weakness. “Patching PHP is easy if you know where it's running. Most organisations don't, not completely,” he said, including sites created “just for testing” years earlier. His advice: “If you can't patch it, protect it. If you can't upgrade it, pull it down.” Singh urged a multilayered approach using runtime protection and Zero Trust, treating websites, mobile applications and AI agents as parts of one digital trust chain.

Don Smith, Vice President of Threat Intelligence at Sophos Counter Threat Unit, said the vulnerabilities had so far proved harder to exploit than initially feared, though the danger remained. He called the response an important learning curve for companies of all sizes and the security industry. “We are in an age of vulnerability discovery, fuelled by advances in AI,” Smith said, adding that the advances create short-term problems and may make the software ecosystem safer and more resilient in the long term. For now, the immediate task is less grand: find the servers, install the updates, and check what happened on systems that couldn't be patched.