Estimating the Economic Costs of Precautionary Downtime and Emergency Patching During the PHP2Shell Incident (CVE-2026-109618 and CVE-2026-109619)

PHP2Shell (CVE-2026-109618, CVE-2026-109619) caused numerous organisations to proactively shut down their services. This research provides an estimation of the cost incurred by proactively shutting down services and reacting to this incident. A listing of 46 reporting units was created based on public documentation. Costs are framed through scenario-based modelling using documented cases as the input population. An opportunity cost of being unavailable was considered, along with incremental cost of reacting to the incident. Transactional and informational services were also considered. The listing of reporting units documents the publicly observed cases. Scenario populations were created where the cost is estimated to be approximately $76,500 to $99.06 million. An example middle scenario was $1.565 million. Verified durations can be added as they become available. The counterfactual analysis shows that if a typical transactional service was shut down immediately compared to continuing operation, it becomes economically favourable to shut down if the probability of a significant compromise occurring during the exposure period is above approximately 0.45% (assuming the loss incurred if compromised to be $1 million). Decisions to shut down depend on the service and will not always be rational or irrational. Decisions to shut down depend on service-specific context. If alternative mitigations are possible then incremental cost and risk should be considered.