PHP (Hypertext Preprocessor) is an open-source, back-end programming language that has been running on web servers since the early 1990s. Maintained today with support from the PHP Foundation, it powers an estimated 70% of the world's websites, including Wikipedia, WordPress, and frameworks such as Laravel and Drupal. That ubiquity is precisely what makes any serious vulnerability in PHP a near-universal threat rather than a niche software problem.
The two flaws tracked as CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell, carry a combined severity score of 9.2 out of 10. The first involves improper handling of out-of-memory errors, which can corrupt memory during request processing. The second involves accessing previously freed memory, a condition that can be chained with the first to enable unauthenticated Remote Code Execution (RCE), meaning an attacker who has never logged into a system can run arbitrary commands on it. Hackers have already attempted to exploit these flaws to install variants of the Mirai botnet, the malware known for hijacking IoT devices to launch large-scale distributed denial-of-service attacks.
The real-world consequences arrived quickly. Wikipedia, the UK and Finnish governments, and several telecom giants suspended services as a precautionary measure. The most striking case was Japan's SoftBank emergency alert suspension, which temporarily took offline the mobile alert system used to warn citizens of earthquakes and tsunamis. A software memory flaw, in other words, briefly disabled a life-safety mechanism.
This is the kind of cascading failure that security professionals describe when they warn about threats to the CIA Triad (Confidentiality, Integrity, Availability). PHP2Shell did not merely risk data theft. It threatened the availability of services that societies depend on in moments of crisis.
What makes this episode instructive for India is the role AI played, and the role it could yet play on the other side. The PHP2Shell vulnerabilities were identified through AI-powered code analysis, demonstrating that machine learning tools can scan vast codebases for subtle memory-handling errors far faster than human auditors. That is the defensive dividend. The offensive liability is symmetrical: the same AI capability can generate working exploits from a published vulnerability description in hours rather than weeks, compressing the window between disclosure and attack.
India's Critical Information Infrastructure (CII), defined under the Information Technology Act as computer resources whose incapacitation could have a debilitating impact on national security, the economy, or public health, is disproportionately exposed to this dynamic. Much of India's CII runs on older legacy systems built for functionality rather than security. These systems may not receive patches promptly, and their administrators may lack the tooling to detect active exploitation. The IT Act's CII protection provisions place nodal responsibility for incident response with CERT-In, the Indian Computer Emergency Response Team, which issues advisories and coordinates remediation across sectors. Advisories, though, are only as effective as the patching culture and technical capacity of the organisations that receive them.
The PHP2Shell episode is a reminder that in an era of AI-assisted vulnerability discovery, the gap between a flaw being found and a flaw being weaponised is shrinking. For a country whose critical sectors, including power grids, banking, telecommunications, and health, still carry significant legacy debt, that compression of time is not an abstract risk. It is an operational one. The question is not whether such flaws will be found in infrastructure-adjacent software, but whether India's institutional and technical response can keep pace with the speed at which AI is rewriting the economics of cyberattack.
With reference to PHP2Shell vulnerabilities, which of the following correctly describes how unauthenticated Remote Code Execution (RCE) is achieved?
Which of the following real-world consequences of the PHP2Shell vulnerabilities is highlighted in the article as the most striking example of a threat to public safety?
Under India's Information Technology Act, which body holds nodal responsibility for incident response concerning Critical Information Infrastructure (CII)?
