{"id":"https://openalex.org/W7225325665","doi":"https://doi.org/10.20944/preprints202611.0480.v1","title":"Estimating the Economic Costs of Precautionary Downtime and Emergency Patching During the PHP2Shell Incident (CVE-2026-109618 and CVE-2026-109619)","display_name":"Estimating the Economic Costs of Precautionary Downtime and Emergency Patching During the PHP2Shell Incident (CVE-2026-109618 and CVE-2026-109619)","publication_year":2026,"publication_date":"2026-11-05","ids":{"openalex":"https://openalex.org/W7225325665","doi":"https://doi.org/10.20944/preprints202611.0480.v1"},"language":"en","primary_location":{"id":"doi:10.20944/preprints202611.0480.v1","doi":"https://doi.org/10.20944/preprints202611.0480.v1","is_oa":true,"landing_page_url":"https://doi.org/10.20944/preprints202611.0480.v1","pdf_url":null,"source":{"id":"https://openalex.org/S6309402219","display_name":"Preprints.org","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"posted-content"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.20944/preprints202611.0480.v1","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5009588266","display_name":"Sukant Khurana","orcid":"https://orcid.org/0000-0002-6665-6892","observed_orcids":["https://orcid.org/0000-0002-6665-6892"]},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Sukant Khurana","raw_affiliation_strings":[],"raw_orcid":"https://orcid.org/0000-0002-6665-6892","affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5160884310","display_name":"Karan Sharma","orcid":"https://orcid.org/0009-0000-6319-3856","observed_orcids":["https://orcid.org/0009-0000-6319-3856"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Karan Sharma","raw_affiliation_strings":[],"raw_orcid":"https://orcid.org/0009-0000-6319-3856","affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5067786582","display_name":"Prajwal Anand","orcid":"https://orcid.org/0009-0007-6060-9036","observed_orcids":["https://orcid.org/0009-0007-6060-9036"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Prajwal Anand","raw_affiliation_strings":[],"raw_orcid":"https://orcid.org/0009-0007-6060-9036","affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5158493562","display_name":"Nitin Bhoyate","orcid":"https://orcid.org/0009-0006-6211-2624","observed_orcids":["https://orcid.org/0009-0006-6211-2624"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Nitin Bhoyate","raw_affiliation_strings":[],"raw_orcid":"https://orcid.org/0009-0006-6211-2624","affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5160919103","display_name":"Arsh Goyal","orcid":"https://orcid.org/0009-0008-8171-6364","observed_orcids":["https://orcid.org/0009-0008-8171-6364"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Arsh Goyal","raw_affiliation_strings":[],"raw_orcid":"https://orcid.org/0009-0008-8171-6364","affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5159078016","display_name":"Tathya Oza","orcid":"https://orcid.org/0009-0003-0825-6756","observed_orcids":["https://orcid.org/0009-0003-0825-6756"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Tathya Oza","raw_affiliation_strings":[],"raw_orcid":"https://orcid.org/0009-0003-0825-6756","affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":["https://openalex.org/A5009588266"],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9667999744415283,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9667999744415283,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.03020000085234642,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":9.999999747378752e-05,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/economic-cost-estimation","display_name":"economic cost estimation","score":0.5299999713897705},{"id":"https://openalex.org/keywords/service-downtime","display_name":"service downtime","score":0.6840000152587891},{"id":"https://openalex.org/keywords/incident-response","display_name":"incident response","score":0.414000004529953},{"id":"https://openalex.org/keywords/counterfactual-analysis","display_name":"counterfactual analysis","score":0.8130000233650208},{"id":"https://openalex.org/keywords/web-application-security","display_name":"web application security","score":0.44200000166893005},{"id":"https://openalex.org/keywords/scenario-modeling","display_name":"scenario modeling","score":0.5659999847412109}],"concepts":[{"id":"https://openalex.org/C3017653385","wikidata":"https://www.wikidata.org/wiki/Q4128962","display_name":"Shut down","level":2,"score":0.8191999793052673},{"id":"https://openalex.org/C180591934","wikidata":"https://www.wikidata.org/wiki/Q1253369","display_name":"Downtime","level":2,"score":0.6621999740600586},{"id":"https://openalex.org/C46355384","wikidata":"https://www.wikidata.org/wiki/Q726686","display_name":"Compromise","level":2,"score":0.5794000029563904},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.5722000002861023},{"id":"https://openalex.org/C2779820595","wikidata":"https://www.wikidata.org/wiki/Q798505","display_name":"Listing (finance)","level":2,"score":0.5722000002861023},{"id":"https://openalex.org/C108650721","wikidata":"https://www.wikidata.org/wiki/Q1783253","display_name":"Counterfactual thinking","level":2,"score":0.5414000153541565},{"id":"https://openalex.org/C93983250","wikidata":"https://www.wikidata.org/wiki/Q795053","display_name":"Cost estimate","level":2,"score":0.4544999897480011},{"id":"https://openalex.org/C2780378061","wikidata":"https://www.wikidata.org/wiki/Q25351891","display_name":"Service (business)","level":2,"score":0.4275999963283539},{"id":"https://openalex.org/C21547014","wikidata":"https://www.wikidata.org/wiki/Q1423657","display_name":"Operations management","level":1,"score":0.4154999852180481},{"id":"https://openalex.org/C145096142","wikidata":"https://www.wikidata.org/wiki/Q5333450","display_name":"Economic cost","level":2,"score":0.385699987411499},{"id":"https://openalex.org/C162118730","wikidata":"https://www.wikidata.org/wiki/Q1128453","display_name":"Actuarial science","level":1,"score":0.3723999857902527},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.3336000144481659},{"id":"https://openalex.org/C2778348673","wikidata":"https://www.wikidata.org/wiki/Q739302","display_name":"Production (economics)","level":2,"score":0.32919999957084656},{"id":"https://openalex.org/C2985697011","wikidata":"https://www.wikidata.org/wiki/Q8134","display_name":"Economic analysis","level":2,"score":0.3237000107765198},{"id":"https://openalex.org/C66887028","wikidata":"https://www.wikidata.org/wiki/Q382444","display_name":"Marginal cost","level":2,"score":0.3224000036716461},{"id":"https://openalex.org/C127454912","wikidata":"https://www.wikidata.org/wiki/Q942582","display_name":"Cost\u2013benefit analysis","level":2,"score":0.31470000743865967},{"id":"https://openalex.org/C96250715","wikidata":"https://www.wikidata.org/wiki/Q965330","display_name":"Estimation","level":2,"score":0.3100999891757965},{"id":"https://openalex.org/C42475967","wikidata":"https://www.wikidata.org/wiki/Q194292","display_name":"Operations research","level":1,"score":0.299699991941452},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.29319998621940613},{"id":"https://openalex.org/C182299520","wikidata":"https://www.wikidata.org/wiki/Q1289588","display_name":"Total cost","level":2,"score":0.290800005197525},{"id":"https://openalex.org/C162324750","wikidata":"https://www.wikidata.org/wiki/Q8134","display_name":"Economics","level":0,"score":0.28360000252723694},{"id":"https://openalex.org/C2983335822","wikidata":"https://www.wikidata.org/wiki/Q942582","display_name":"Cost analysis","level":2,"score":0.2786000072956085},{"id":"https://openalex.org/C87864170","wikidata":"https://www.wikidata.org/wiki/Q16897780","display_name":"Unit cost","level":2,"score":0.2728999853134155},{"id":"https://openalex.org/C95821633","wikidata":"https://www.wikidata.org/wiki/Q973302","display_name":"Cost driver","level":2,"score":0.2651999890804291},{"id":"https://openalex.org/C192365026","wikidata":"https://www.wikidata.org/wiki/Q5046829","display_name":"Holding cost","level":2,"score":0.2635999917984009},{"id":"https://openalex.org/C6964187","wikidata":"https://www.wikidata.org/wiki/Q659256","display_name":"Indirect costs","level":2,"score":0.2572000026702881},{"id":"https://openalex.org/C2780945871","wikidata":"https://www.wikidata.org/wiki/Q194274","display_name":"Backup","level":2,"score":0.2547000050544739},{"id":"https://openalex.org/C188897","wikidata":"https://www.wikidata.org/wiki/Q5333508","display_name":"Economic impact analysis","level":2,"score":0.25380000472068787}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.20944/preprints202611.0480.v1","doi":"https://doi.org/10.20944/preprints202611.0480.v1","is_oa":true,"landing_page_url":"https://doi.org/10.20944/preprints202611.0480.v1","pdf_url":null,"source":{"id":"https://openalex.org/S6309402219","display_name":"Preprints.org","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"posted-content"}],"best_oa_location":{"id":"doi:10.20944/preprints202611.0480.v1","doi":"https://doi.org/10.20944/preprints202611.0480.v1","is_oa":true,"landing_page_url":"https://doi.org/10.20944/preprints202611.0480.v1","pdf_url":null,"source":{"id":"https://openalex.org/S6309402219","display_name":"Preprints.org","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"posted-content"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W7225063027","https://openalex.org/W7097785075","https://openalex.org/W89739554","https://openalex.org/W7223305143","https://openalex.org/W7096024728","https://openalex.org/W2774718154","https://openalex.org/W7223557827","https://openalex.org/W2497303274","https://openalex.org/W7224922233","https://openalex.org/W7172111415"],"abstract_inverted_index":{"PHP2Shell":[0],"(CVE-2026-109618,":[1],"CVE-2026-109619)":[2],"caused":[3],"numerous":[4],"organisations":[5],"to":[6,28,70,99,103,137,144,169,174,190],"proactively":[7,22],"shut":[8,133,145,175,191],"down":[9,24,134,146,176,192],"their":[10],"services.":[11],"This":[12],"research":[13],"provides":[14],"an":[15],"estimation":[16],"of":[17,33,59,68,82,150],"the":[18,53,71,86,95,148,156,164,179],"cost":[19,58,67,96,204],"incurred":[20,166],"by":[21],"shutting":[23],"services":[25,76],"and":[26,74,181,205],"reacting":[27,69],"this":[29],"incident.":[30,72],"A":[31],"listing":[32,81],"46":[34],"reporting":[35,83],"units":[36,84],"was":[37,62,110,132],"created":[38,93],"based":[39],"on":[40,178,194],"public":[41],"documentation.":[42],"Costs":[43],"are":[44,200],"framed":[45],"through":[46],"scenario-based":[47],"modelling":[48],"using":[49],"documented":[50],"cases":[51],"as":[52,118],"input":[54],"population.":[55],"An":[56,106],"opportunity":[57],"being":[60],"unavailable":[61],"considered,":[63],"along":[64],"with":[65],"incremental":[66,203],"Transactional":[73],"informational":[75],"were":[77,92],"also":[78],"considered.":[79,209],"The":[80,122],"documents":[85],"publicly":[87],"observed":[88],"cases.":[89],"Scenario":[90],"populations":[91],"where":[94],"is":[97,159],"estimated":[98],"be":[100,116,170,185,208],"approximately":[101,161],"$76,500":[102],"$99.06":[104],"million.":[105,112],"example":[107],"middle":[108],"scenario":[109],"$1.565":[111],"Verified":[113],"durations":[114],"can":[115],"added":[117],"they":[119],"become":[120],"available.":[121],"counterfactual":[123],"analysis":[124],"shows":[125],"that":[126],"if":[127,147,167],"a":[128,151],"typical":[129],"transactional":[130],"service":[131,180],"immediately":[135],"compared":[136],"continuing":[138],"operation,":[139],"it":[140],"becomes":[141],"economically":[142],"favourable":[143],"probability":[149],"significant":[152],"compromise":[153],"occurring":[154],"during":[155],"exposure":[157],"period":[158],"above":[160],"0.45%":[162],"(assuming":[163],"loss":[165],"compromised":[168],"$1":[171],"million).":[172],"Decisions":[173,189],"depend":[177,193],"will":[182],"not":[183],"always":[184],"rational":[186],"or":[187],"irrational.":[188],"service-specific":[195],"context.":[196],"If":[197],"alternative":[198],"mitigations":[199],"possible":[201],"then":[202],"risk":[206],"should":[207]},"counts_by_year":[],"updated_date":"2026-11-09T13:22:03.289127","created_date":"2026-11-06T00:00:00"}