On 22 October 2026, more than 23,000 Swiss-linked servers were still vulnerable to PHP2Shell, a critical double PHP flaw, despite the emergency patches released the day before. The company Risikomonitor carried out the survey, ICTjournal reports. Exploitation attempts have been observed, with no damage reported so far. For SME cybersecurity, the risk lies mainly in the website and the online shop.
How many servers remain exposed in Switzerland?
Risikomonitor, which specialises in automated website analysis, examined nearly 690,000 servers with a link to Switzerland. It found just over 23,000 still affected by PHP2Shell, or about 3.5%.
This figure is probably a minimum. According to ICTjournal, the real number could be higher, because the installed PHP version cannot always be detected from the outside.
Global data from VirusTotal points in the same direction. On 21 October 2026, its scanner spotted more than 5 million PHP servers, but could only date the version for a quarter of them.
| Survey | Scope | Servers examined | Result |
|---|---|---|---|
| Risikomonitor, 22 October 2026 | Swiss-linked servers | Nearly 690,000 | Just over 23,000 still vulnerable (about 3.5%) |
| VirusTotal, 21 October 2026 | Worldwide | More than 5 million | Version identified for a quarter; more than 700,000 end-of-life, with no patch |
The most worrying point concerns these end-of-life versions. Among the servers whose version is known, they are the most widespread. They receive no official emergency patch.
Have the attacks already begun?
Exploitation attempts have indeed taken place, but no attack causing damage has been reported. According to Bleeping Computer, citing Amazon Threat Intelligence, they began four days before the patches were released. Several cybercriminal groups reportedly tested different methods, without success.
Cloudflare describes the same pressure. Its chief executive, Matthew Prince, said on X that he had seen thousands of attempts before public disclosure, then tens of thousands in the following 45 minutes. Their number then reached several million.
An attempt is not an intrusion. ICTjournal stresses that these figures do not correspond to successful attacks, whose scale remains difficult to measure.
Who is affected in Switzerland?
Any organisation running PHP is potentially affected, from a municipal website to an SME's shop. PHP powers about three out of four websites, including all WordPress sites, as our article on the PHP2Shell PHP flaw pointed out.
Sites in French-speaking Switzerland have also been taken offline. ICTjournal's editorial team observed that the websites of the University of Geneva and EPFL had been temporarily disconnected. These were preventive measures, not confirmed compromises.
The web server is not the only concern. The Federal Office for Cybersecurity (FOCS) points out that the risk also affects internal applications, administration interfaces and devices that embed PHP.
How to check your PHP version?
The first step is to know which version is running, and where. For a hosted site, PHP is usually managed by the hosting provider: simply ask them which version is installed and whether the PHP2Shell patch has been applied.
The answer is then compared with the patched versions released by the PHP developers:
- PHP 8.5: version 8.5.12;
- PHP 8.4: version 8.4.27;
- PHP 8.3: version 8.3.36;
- PHP 8.2: version 8.2.35;
- PHP 8.1 and older: no new official version; only minimal patches, Linux distributors' packages or a migration offer protection.
The PHP developers are clear: no mitigation measure fully replaces updating the PHP server. The temporary settings detailed in our first article only reduce certain attack paths.
The inventory matters as much as the update. All PHP installations must be listed, including an old forgotten site, a forum or a statistics tool provided by a third party.
What the Federal Office for Cybersecurity recommends
As early as 21 October 2026, the FOCS recommended installing the patches immediately. It warned that the two vulnerabilities could allow malicious code to be executed on a server without authentication. Referenced as CVE-2026-109618 and CVE-2026-109619, they are rated 9.2 out of 10.
The office's advice boils down to three steps:
- update the affected systems without delay;
- check, beyond the web server, the applications and devices that integrate PHP;
- report an incident if in doubt: the FOCS receives voluntary reports and runs an on-call line 24h/24.
These steps match the basic IT security measures that the office advises companies to take: fast updates, protected access and a response plan.
What PHP2Shell changes for an SME
Our analysis: PHP2Shell puts to the test a weakness already known among Swiss SMEs, the inventory. According to the study on SME cybersecurity published on 22 October 2026, more than 80% of SMEs install updates. But only about a third keep an inventory of their IT systems.
Yet an update only protects the machines that are known. The showcase website entrusted to an agency, the online shop or the internal tool hosted by a service provider easily slip off the list.
An SME that wants to gauge its level can start with an SME cybersecurity test, such as the Cybersecurity-Check. This free assessment notably detects outdated software, one of the frequent causes of successful attacks.
Why did the flaw take so long to fix?
The PHP Foundation acknowledges that a problem at the origin of the first flaw had already been identified in 2024. Its potential for exploitation was not fully understood at the time, it writes in a blog post published on 21 October 2026.
The organisation attributes this delay to decision-making difficulties and a lack of resources in its security team.
Artificial intelligence (AI) played an important role in the discovery. The company Wiz says it used several models, including Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol, to find the flaws, build exploitation scenarios and verify the patches. The researcher Calif also identified a critical vulnerability with GPT-5.6 Sol, as part of OpenAI's "Patch the Planet" initiative.
What we do not know yet
The real number of vulnerable servers in Switzerland remains unknown, since the PHP version cannot always be detected. Nor does the Risikomonitor survey specify how many Swiss servers run an end-of-life version.
None of the sources consulted reports a successful intrusion in Switzerland. It is also unknown when all the sites taken offline as a precaution were brought back online.
