PHP2Shell Cyber Threat Hits 7pc of Kenyan Organisations, Check Point Reports

Seven per cent of organisations in Kenya have been affected by the PHP2Shell cybersecurity threat, according to new data from Check Point Research, as attackers exploit two critical vulnerabilities in software that powers a large share of the internet.

The findings show that 10 per cent of organisations globally have been impacted since details of the vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, leaked ahead of their planned disclosure.

The vulnerabilities could allow attackers to execute malicious code remotely on affected servers without logging in, potentially exposing websites, business applications and other internet-facing systems to compromise.

Europe has recorded the highest regional impact, with 14 per cent of organisations affected, compared with six per cent each in North America, Latin America and Asia-Pacific. Africa recorded the lowest rate at four per cent.

However, Check Point Software Technologies has cautioned that Africa's lower recorded impact should not be interpreted as evidence of stronger cybersecurity, particularly as businesses and public institutions across the continent expand their digital operations.

“??Africa’s lower impact today should be seen as an opportunity to strengthen our defences, not as evidence that we are somehow safer,” said Ian van Rensburg, Head of Security Engineering for Africa at Check Point Software Technologies.

“The real test isn't how often we're targeted, but how prepared we are when we are.”

Van Rensburg said differences in digital maturity, PHP adoption and the volume of internet-facing infrastructure could partly explain the regional variations. Attackers also tend to concentrate their efforts where they find large numbers of vulnerable systems and greater potential financial returns.

He warned, however, that variations in security monitoring and threat intelligence coverage could affect the reported figures, meaning some attacks may go undetected or unreported.

The findings come as organisations increasingly rely on digital platforms, cloud services and interconnected systems, expanding the potential attack surface for cybercriminals.

Europe's exposure is particularly pronounced at country level, with 16 of the 18 most affected countries located in the region. Hungary leads with 38 per cent of organisations affected, followed by Denmark at 32 per cent and Austria at 28 per cent. Sweden and Romania each recorded 22 per cent.

Portugal, Thailand and Serbia recorded 17 per cent, while Germany registered 16 per cent and the Netherlands 15 per cent. India recorded 14 per cent, followed by Norway and Ukraine at 13 per cent each. Czechia, Poland, Spain, Switzerland and the United Kingdom each recorded 12 per cent.

The telecommunications sector is the most affected industry globally, with 20 per cent of organisations impacted, twice the overall rate. Education follows at 18 per cent, while media and entertainment, and associations and non-profit organisations, each recorded 16 per cent.

Agriculture and transportation and logistics recorded 14 per cent each, followed by software and healthcare at 13 per cent and information technology at 12 per cent. Government organisations recorded nine per cent, while financial services registered eight per cent. Biotechnology and pharmaceuticals had the lowest recorded impact among the 23 industries tracked, at five per cent.

PHP2Shell has attracted particular concern because of PHP's widespread use in websites, e-commerce platforms and enterprise applications. The programming language underpins many websites built using content management systems such as WordPress, Drupal, Joomla and Magento, as well as shared hosting services and commercial applications.

According to Check Point, the vulnerabilities affect the PHP engine itself, meaning that updating a website's content management system or plugins alone will not resolve the underlying security risk. The PHP installation on the server must also be patched.

The threat has already prompted precautionary action by government institutions in the Netherlands and Finland, which have taken websites offline to reduce the risk of exploitation. Screenshots of a PHP2Shell attack tool are also circulating, adding to concerns about the speed at which malicious actors could operationalise the leaked information.

Lotem Finkelstein, Vice President of Research at Check Point Software Technologies, said the combination of the vulnerabilities' severity and PHP's widespread adoption had significantly increased the urgency for organisations to assess their exposure.

“The leak of their details ahead of the planned disclosure is narrowing the window for security teams to prepare,” Finkelstein said.

He urged organisations to identify all PHP installations across their infrastructure, including those running in containers and third-party products, and prioritise internet-facing servers and unsupported software versions.

Finkelstein said organisations should also prepare to deploy official security updates as soon as they become available and introduce additional protective measures where immediate patching is not possible.

He further advised security teams to monitor suspicious activity, including web server processes executing system commands, unexpected files appearing on websites and outbound connections to unfamiliar destinations.

The growing role of artificial intelligence in cybersecurity is adding another layer of urgency, according to Finkelstein, who said AI is accelerating vulnerability discovery and exploitation, leaving security teams with less time to respond.

Charlotte Wilson, Head of Enterprise at Check Point Software Technologies, said the vulnerabilities demonstrated how a weakness in widely used technology could expose large numbers of organisations simultaneously.

She compared the situation to millions of buildings relying on the same faulty lock, leaving their occupants vulnerable once criminals discover how to open it.

Wilson also pointed to growing concerns about dependence on a limited number of technology providers to maintain essential services, noting that regulators are paying closer attention to the role these providers play in critical infrastructure.

She said warnings from the UK's National Cyber Security Centre about artificial intelligence increasing the frequency and intensity of cyberattacks further underlined the need for organisations to strengthen their defences.

For African businesses, Van Rensburg said the immediate priority should be to establish their exposure, patch vulnerable systems promptly and maintain preventive security controls while remediation is under way.

He warned that geographical boundaries offer no protection against cybercrime and that vulnerabilities can be exploited within hours of their details becoming public.

The figures are based on Check Point customer telemetry. Further technical analysis and updates on PHP2Shell are available on the company's [security research blog]