Companies and hosting providers in the UAE are racing to fix critical vulnerabilities in PHP, a widely used programming language, after cybersecurity experts warned that thousands of internet-facing systems could be exposed to attacks.
The vulnerabilities, known as PHP2Shell, could allow attackers to execute malicious code remotely without authentication.
According to Censys, 4,691 internet-facing hosts in the UAE may be vulnerable, accounting for 79.5 percent of the country's total versioned hosts. The UAE ranks 71st among 233 countries and territories monitored.
Pushkar Singh, head of Middle East and Africa at Protectt.ai, said that firms in the UAE had been updating PHP packages and shared hosting environments, while advising users to check their software versions and reboot their websites.
Singh said the response reflected the UAE’s emphasis on proactive threat management and digital resilience. He further noted that cybersecurity needs continual patching of vulnerabilities, run-time protection and threat intelligence. As per cybersecurity experts, around 70 percent of sites that have known server-side programming languages use PHP.
The US National Security Agency has urged organisations to take websites offline if they cannot immediately fix the flaws. Tenable Research has classified them as a 'Vulnerability of Concern', its highest category under the Vulnerability Watch program.
Satnam Narang, senior staff research engineer at Tenable, said the flaws could enable unauthenticated remote code execution, while one could also expose memory.
Gavin Millard, vice president of intelligence at Tenable, said the vulnerabilities had remained in code used by roughly seven in 10 websites for more than a decade. The vulnerabilities were discovered in August and disclosed this week, with exploitation attempts reported within hours of disclosure, he said
Narang said patch availability would depend on the software provider. Updated packages could arrive within hours or days for supported Linux distributions, while outdated PHP versions might take weeks or months to address.
Also Read: PHP Security Flaws Trigger Millions of Hacking Attempts Worldwide
Meriam ElOuazzani, Censys vice president for the Middle East, Turkey and Africa, urged organisations to identify affected installations, apply security updates and verify that fixes had worked. Security teams should also investigate unusual activity and assess legacy systems.
Millard warned that forgotten servers could remain vulnerable, particularly those created for testing and subsequently neglected. Pushkar Singh recommended runtime protection and Zero Trust security measures.
Don Smith, vice president of threat intelligence at Sophos Counter Threat Unit, said the vulnerabilities had proved harder to exploit than initially feared, but warned that the danger remained.
He said AI-driven vulnerability discovery could create short-term challenges while ultimately making software ecosystems safer and more resilient.