PHP2Shell may be responsible if you’ve struggled to load government portals, local banking interfaces, or your favourite online stores today. A massive, zero-day vulnerability in PHP, the programming language powering nearly 75% of the web, has forced organisations in South Africa and worldwide to voluntarily take their sites offline to protect user data.
The crisis centres around two critical flaws collectively dubbed “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619). Both carry a near-maximum severity score of 9.2 out of 10.
Why PHP2Shell Puts Websites at Risk. Security experts warn that the exploit requires no login and strikes the PHP engine itself before any application-level security checks can run. This means popular platforms like Magento, WordPress, and WooCommerce are exposed even if their own code is perfectly secure.
According to local tech publication MyBroadband, thousands of Internet servers in South Africa are at risk of being taken over. The exploit allows attackers to execute code remotely, giving them full control over the server. Security firm Sansec also noted that CVE-2026-109618 “leaks memory on its own, similar to Heartbleed,” potentially exposing passwords, session tokens, and API keys.
How the PHP2Shell Crisis Unfolded. The timeline of the crisis has been chaotic. Security researchers independently discovered the vulnerabilities in August by security firm Calif (as part of an OpenAI project) and cloud security company Wiz. A coordinated patch release was planned for Thursday, 22 October. However, details leaked on hacker forums on 20 October.
The leak forced the PHP maintainers into crisis mode. They rushed the emergency patches out at 16:00 SAST (14:00 UTC) on Wednesday, 21 October. Unfortunately, threat actors were already moving. Cloudflare reported early attacks starting at 09:43 SAST, over six hours before the official patch was available.
With no configuration mitigations available and active exploitation underway, international bodies like CERT-EU advised organisations to isolate vulnerable internet-facing applications.
This led to a wave of precautionary shutdowns globally and locally. While major international portals and forums went dark, South African IT administrators faced the daunting task of auditing their environments. As one security researcher pointed out to The Record, the real danger lies in forgotten systems: “an old marketing site, a hosting control panel, a device with PHP built in.”
Why South African Websites Face Greater Risk. The situation is particularly dire in South Africa, where many budget web hosts and older corporate sites are still running PHP 8.1 or older. PHP 8.1 officially reached its end of life (EOL) on 31 December 2025, meaning it no longer receives official security updates from the PHP Foundation. Because these legacy versions will not be patched for PHP2Shell, countless local sites are now permanently exposed to a critical zero-day exploit unless their hosting providers immediately force upgrades to supported versions like 8.3 or 8.4, which risks breaking older websites.
Our PHP2Shell Response at ITFirst
Here at ITFirst in Centurion, we understand how critical uptime and security are to your business. We want to assure our clients that our response has been swift. We can confirm this afternoon that all vulnerabilities have already been patched across our dedicated hosting servers with zero downtime. We are actively monitoring the situation and will provide further feedback and status updates regarding our shared hosting services shortly.
The fixes are now available in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. If you manage a server running a supported version of PHP, security experts stress that you must apply the patches immediately. For those who cannot patch, temporary mitigation involves putting the application behind Cloudflare’s WAF (which has emergency rules deployed) or taking the site offline entirely until it can be secured.
