On Wednesday 21 October 2026, PHP developers released emergency security updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 out of 10 on the severity scale.
By Friday 23 October, South Africa’s Presidency had taken its website offline.
The speed of that sequence is the story.
PHP is the programming language that quietly underpins 69% of all websites globally. WordPress, Drupal, Joomla and Magento all run on it. Shared hosting platforms, government portals, hospital systems, online shops, banking interfaces and internal enterprise applications all run on it. Cybersecurity company Huntress put it plainly in a blog post that circulated widely this week: PHP is everywhere. It quietly powers software that does not even advertise that it runs PHP under the hood.
Both vulnerabilities allow unauthenticated remote code execution. That means an attacker who finds an unpatched PHP installation can run malicious commands on that server without needing a username or password. The FBI described it on X: the flaws often provide a direct path to the server’s file system or database. The US NSA urged organisations to take websites offline if they could not immediately apply the fix. The EU Computer Emergency Response Team, the Australian Cyber Security Centre and agencies across Europe issued urgent advisories simultaneously.
Germany, Finland, Belgium, the Netherlands and France took government websites offline as a precaution. The White House assessed potential impacts. South Africa’s Presidency followed on Friday, posting on X that its website was temporarily unavailable as a precautionary measure in response to a global cybersecurity event. Presidential spokesperson Vincent Magwenya told Reuters there was no indication of a security breach.
Patches for multiple PHP versions were released at 4pm South African time on Wednesday. The question for every South African organisation running PHP-based infrastructure is how many hours passed between that release and the patch being applied.
The AI dimension that changes the urgency calculation.
What makes this vulnerability disclosure different from most is how researchers discovered the flaws. Security researchers at cloud security firm Wiz used AI-assisted analysis to identify both vulnerabilities. The same AI capabilities being deployed for defensive security research are being used offensively to find and exploit gaps before patches arrive.
Leaked vulnerability details forced the PHP security team to accelerate their release by one day after proof-of-concept exploits began circulating before the official fixes were available. The window between disclosure and active exploitation was measured in hours, not days.
This operational reality makes the traditional patch management cycle insufficient for critical-severity vulnerabilities in 2026. The assumption that organisations have days or weeks to assess and apply a patch before exploitation begins no longer holds for vulnerabilities of this severity in infrastructure this widely deployed. When AI compresses the timeline from disclosure to a working exploit to hours, the patch window closes before most change control processes complete their first approval step.
What South African organisations need to know right now.
The patches are available. Administrators must install them manually because automatic platform updates do not apply the fix. Organisations running older, unsupported PHP versions require specific remediation steps to address the exposure. The EU CERT and ACSC both urged organisations to monitor servers for unusual activity, including PHP processes unexpectedly launching command shells or downloading files, which are indicators of active exploitation.
The scope of affected infrastructure in South Africa is significant. Every organisation running a public-facing website, a content management system, a customer portal, a supplier interface or an internal web application built on PHP-based frameworks is potentially in scope. That includes organisations that are not aware their infrastructure runs PHP because the language operates below the surface of the platforms they use.
The Presidency’s precautionary shutdown is the right call in the circumstances. Removing a public-facing system from exposure while patches are applied is exactly the kind of decisive response that limits risk during a narrow and active exploitation window. It also illustrates a principle worth internalising beyond this specific incident: the ability to take a system offline quickly, and to have a plan for what happens operationally when you do, is itself a security capability. Organisations that have never asked what the consequence of taking a system offline for 12 hours would be are less prepared to make that decision under pressure than those that have.
The broader lesson this week is writing itself in real time.
AI discovered vulnerabilities in one of the internet’s most foundational programming languages. Proof-of-concept exploits leaked before the official patches were ready. Government websites went dark across multiple continents. South Africa’s Presidency took its site offline three days after the disclosure.
The timeframe from AI-assisted discovery to global security event to South African government response was 72 hours.
That is the patch window organisations are now working inside. Not weeks. Not days. Hours.
Every South African organisation that has not yet verified its PHP patch status, checked whether its web infrastructure is exposed, and confirmed that its monitoring is watching for the indicators CERT agencies have published, is carrying an active exposure that has been publicly known since Wednesday.
