Companies and hosting providers across the UAE are moving to address newly disclosed PHP vulnerabilities known as PHP2Shell, deploying security updates and reviewing internet-facing systems as cybersecurity experts warn that attackers could exploit the flaws to gain access to servers.
The response includes updating PHP packages, securing shared hosting environments and advising customers to check their software versions and restart web services after applying patches.
Pushkar Singh, regional head for the Middle East and Africa at Protectt.ai, said the UAE’s response demonstrated a growing focus on proactive threat management and digital resilience. He stressed that cybersecurity requires continuous monitoring, timely patching and coordinated threat intelligence rather than a one-off compliance exercise.
According to Censys, 4,691 internet-facing hosts in the UAE are potentially exposed to the vulnerabilities, accounting for 79.5% of the country’s versioned hosts. The UAE ranked 71st among 233 countries and territories assessed.
Singh said estimates suggesting that around three-quarters of websites use PHP indicated that a substantial number of UAE enterprise websites could be affected. However, the level of risk for individual organisations depends on whether their installations have been patched, how their applications are configured and whether the systems are accessible externally.
The warnings have also prompted action internationally. The US National Security Agency urged organisations to take websites offline if they could not immediately fix the two flaws, warning that exploitation could provide attackers with a route to server files or databases.
Tenable Research classified the vulnerabilities as a “Vulnerability of Concern”, its highest category under the Vulnerability Watch programme. Satnam Narang, a senior staff research engineer at Tenable, said the flaws were particularly significant because of PHP’s widespread use.
The vulnerabilities affect PHP itself and can enable unauthenticated remote code execution, allowing attackers to run commands on vulnerable systems without first logging in. One of the flaws can also expose memory contents, according to Narang.
Gavin Millard, vice president of intelligence at Tenable, said the vulnerabilities had remained in code used by a large proportion of websites for more than a decade. Discovered in August and disclosed this week, they attracted exploitation attempts within hours, he said, as attackers used the newly available information to work out how to exploit the weaknesses.
Artificial intelligence is accelerating this process by helping attackers analyse changes between vulnerable and patched code, Millard added.
Patching times vary. Mainstream Linux distributions and long-term support providers may release updated packages within hours or days, while less common repositories could take longer. Systems running unsupported PHP versions may face delays of weeks or months, and some may never receive updates.
Meriam ElOuazzani, Censys vice president for the Middle East, Turkey and Africa, urged organisations to identify affected installations, apply patches and verify that fixes had worked. Security teams should also investigate unusual activity and assess legacy systems that are difficult to update.
Experts said organisations unable to patch vulnerable systems should restrict access or take them offline. Don Smith of Sophos Counter Threat Unit said the flaws had proved harder to exploit than initially feared, but warned that the threat remained. He added that AI-assisted vulnerability discovery would require businesses and the cybersecurity industry to improve their defences.
