Pretoria pulled its presidential website offline on Friday as a precaution against PHP2Shell — two critical flaws in the PHP engine that powers most of the web, triggering emergency patches and alerts from the FBI, the UK's NCSC and Ghana's cyber authority.
Published 23 October 2026 · 18:49 GMT
Pretoria pulled its presidential website offline on Friday as a precaution against PHP2Shell — two critical flaws in the PHP engine that powers most of the web, triggering emergency patches and alerts from the FBI, the UK's NCSC and Ghana's cyber authority. South Africa’s Presidency took its website offline on Friday, October 23, 2026, as a precaution ‘in response to a global cybersecurity event’ (@PresidencyZA on X). Presidential spokesperson Vincent Magwenya told Reuters there was ‘no indication of a security breach’; the site was taken down as a precaution.
On Friday, October 23, 2026, South Africa’s Presidency announced on X that its website was temporarily unavailable as a precautionary measure ‘in response to a global cybersecurity event’; presidential spokesperson Vincent Magwenya told Reuters there was ‘no indication of a security breach.’ The event is the disclosure of two critical PHP vulnerabilities — CVE-2026-109618 and CVE-2026-109619, dubbed PHP2Shell — each rated 9.2 on CVSS v4.0, enabling unauthenticated remote code execution in PHP’s core; emergency fixes (PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35) were released on October 21, 2026.
The severity framing. The PHP project and most vendors rate the flaws 9.2; some external researchers assess them at the maximum 10.0.
How long the Presidency’s site will stay offline or whether it was examined for compromise; the true scale of real-world exploitation during the embargo window; who leaked the flaws and why; whether Linux distributions and LTS vendors will deliver reliable backports for PHP 7.4, 8.0 and 8.1, which get no new release; and how many of the 9,800-plus exposed South African servers were patched before the weekend.
On Friday morning, October 23, 2026, the Presidency's official website was a dead page. Within hours, the @PresidencyZA account on X explained the silence: “Please be advised that The Presidency website is temporarily unavailable as a precautionary measure in response to a global cybersecurity event,” the post read. No timeline for restoration was given.
Daily Maverick reported that hours after the announcement the site still displayed “This site can’t be reached.” The shutdown is precautionary, not a confirmed breach: presidential spokesperson Vincent Magwenya told Reuters on Friday that there was “no indication of a security breach.” “While such warnings do not indicate a security breach, they can affect the normal operation of a website,” Magwenya said, adding that the website had been taken down as a precaution.
PHP2Shell names two critical vulnerabilities in PHP itself: CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 on CVSS v4.0, and each can allow an unauthenticated attacker to run code on a server handling PHP requests, per the PHP security team, Sygnia and Sygnia and UC Berkeley's Information Security Office.
The flaws sit in PHP's core request-handling path, not in any website application: CVE-2026-109618 abuses out-of-memory handling to leave request data half-built, and CVE-2026-109619 is a use-after-free flaw where workers retain stale references to freed memory. The PHP project validated unauthenticated remote code execution over HTTP against Apache's mod_php and rates that configuration the highest risk; PHP-FPM and others are also exposed.
The emergency fixes, published October 21, 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older get no new release, only minimal source backports for 7.4, 8.0 and 8.1. “Updating is the only complete fix,” the advisory says — and every PHP worker must be restarted afterwards.
The discovery trail is unusual. Wiz Research found the flaws using AI models and announced them on October 21 alongside the PHP security updates, after working with researchers at Google, OpenAI and AWS, Mint reported. The PHP Foundation's blog says Calif began its audit in late July and reported an unconditional remote code execution on August 11 with the same root cause OpenAI found.
Pretoria is not alone in facing that choice: an EU agency warned this week that websites across the bloc may need to go offline for the same PHP patches — our Patch Wednesday report.
The Presidency has not said how long its website will stay offline, nor whether it checked the site for compromise before taking it down. There is no indication of a breach, but the Presidency has disclosed no findings, no audit, and no restoration date.
Beyond South Africa, the largest unknown is the blast radius. Palo Alto Networks counts 22.6 million exposed instances in its own telemetry, and the extent of successful real-world compromise remains unknown — attack traffic has been observed, and Cloudflare says exploitation has started, but no confirmed-compromise inventory exists. Sygnia is explicit: patching does not undo a compromise; previously exposed systems must be investigated for suspicious activity, file changes, persistence mechanisms and stolen credentials.
Two unknowns hang over the timeline. Amazon Threat Intelligence recorded an exploitation attempt on October 17 — four days before the fix — while the flaws were under embargo; who else was probing is unknown. And an anonymous Hacker News post on October 20 published the CVE identifiers and an inflated CVSS 10.0 score; WatchTowr confirmed the leak was legitimate, prompting PHP to bring the release forward. The poster's identity and motive are unknown.
PHP is the invisible engine of the public web. Per web-technology tracker W3Techs, cited by Reuters, it runs nearly 70% of identifiable websites — and it is the engine behind WordPress, which powers about 40% of all websites; Drupal and Joomla run on it too. A critical vulnerability in PHP's core is therefore not a bug in one application: it is a fault in the foundation, and every site built on it inherits the exposure.
The numbers are what moved governments. In South Africa alone, a Shodan search returned more than 9,800 internet-connected servers running PHP — including Amazon Data Services South Africa, Afrihost, Xneelo and Microsoft, MyBroadband reported. That a presidency took its own website dark tells every chief information officer on the continent that this is not a drill.
The likely answer is time and certainty: patching a production server means updating the runtime, restarting every worker, and verifying nothing else breaks. The FBI's own guidance, published Wednesday, gave organizations explicit permission to do exactly what Pretoria did: “If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated.” For a head-of-state website, the cost of an hour's downtime is embarrassment; the cost of a compromise is a national incident. Pretoria chose embarrassment.
There is a striking detail in the FBI Cyber Division's Wednesday post: take the system offline if you cannot update immediately. Two days later, that is precisely what South Africa's Presidency did. Rarely does a government execute a foreign agency's incident guidance in real time — rarer still to say so openly. That candour is itself a signal: the threat is severe enough that silence is worse than admitting a precaution.
Wiz's AI-assisted audit, OpenAI's parallel discovery of the same root cause, and Calif's months-long review mark a turning point: the AI models defenders use to find memory-safety bugs at scale are available to attackers. Mint's explainer warns the discovery raised concern about how easily AI can now build complex cyberattacks. The embargo system cracked under that pressure: probed October 17, leaked October 20, release moved up. Disclosure discipline is now a race against the tooling that finds the bugs.
Almost everyone patched on October 21 or later. The four-day gap between the first recorded exploitation attempt and the public fix is this incident's heaviest unknown. Few organizations can say with certainty they were not probed in that window; those on PHP 8.1 or older, with no new release at all, depend on source backports and their distribution's goodwill. The scramble favours whoever moves fastest, and that has not been the defenders: CVE-2024-4577 was exploited within 24 hours of its June 2024 disclosure.
The same week, Magna Bureau examined how AI is reshaping cyber defence — the other side of the same coin.
The immediate second-order risk is the long tail: millions of small businesses, municipal portals, clinics, schools and news sites run old PHP on shared hosting, and many will never patch. Vendors are filling the gap where they can, but even the FBI-endorsed mitigations are stopgaps — disabling the rarely used session.upload_progress feature blocks one confirmed attack path, not the vulnerability.
CrowdStrike, via MyBroadband, adds nuance: successful exploitation yields command execution only in the web server user's security context. But credential theft, web-shell installation and lateral movement are all achievable without root — for banks, government services and online stores, that is more than enough.
The African dimension is concrete, not rhetorical. Ghana's Cyber Security Authority and its National Information Technology Agency jointly alerted government institutions, website owners, businesses and hosting providers on Friday, warning the flaws “could allow attackers to take control of affected servers without a username or password.” The continent's e-government push — portals for taxes, IDs, tenders, services — runs disproportionately on the same PHP-and-WordPress stack PHP2Shell targets. A decade of digitisation has concentrated risk in one runtime; this week priced that concentration.
For a sense of what a successful intrusion looks like at street level, see our report on the French supermarket cyberattack.
Three things to watch: when the Presidency's website returns, and whether it says anything about what it found. A clean restoration with no further comment would suggest the precaution worked; an extended outage or forensics disclosure would suggest otherwise. Second, the exploit wave: with exploit code circulating, in-the-wild compromise reports in the coming days will show whether the embargo breach translated into real intrusions. Third, the orphaned branches: whether distributions and long-term-support vendors ship reliable backports for PHP 7.4, 8.0 and 8.1, or whether a vast installed base stays exposed indefinitely. The next critical flaw may not get even this much warning.
How the West tells it Western coverage has treated PHP2Shell as a systemic incident. Reuters' Johannesburg bureau broke the Presidency angle and framed the flaws as “one of the most significant cybersecurity incidents in recent years,” with “millions of hacking attempts.” The institutional response was American and British: the FBI's Wednesday post gave the playbook, the UK's NCSC issued its own alert. The technical vanguard — Wiz, CrowdStrike, Palo Alto Networks, Cloudflare, Fortinet, Sygnia — set the consensus at 9.2.
How the East tells it Asia's response was operational. Singapore's CSA issued an alert the same day the fix landed; Korea's KISA advised immediate updates, and Korean firm Piolink opened a free “php2shell emergency check” page. India's Mint ran a full explainer on the AI-discovery angle, and the ASEAN press published step-by-step remediation analysis.
How the Global South tells it The Global South is not a bystander in this story — it is the terrain. South Africa originated the headline: Daily Maverick's original reporting put the Presidency's shutdown on the record, and MyBroadband quantified the exposure with a Shodan sweep — 9,800-plus PHP servers, including the country's biggest hosts. Ghana's CSA and NITA acted the same day with the same warning.
As a precaution against PHP2Shell, two critical flaws in the PHP programming language disclosed this week. The Presidency said on X that the site was ‘temporarily unavailable as a precautionary measure in response to a global cybersecurity event.’ Spokesperson Vincent Magwenya told Reuters there was no indication of a security breach. The FBI had advised organizations to take systems offline if they could not patch immediately.
The name for two critical vulnerabilities in PHP itself — CVE-2026-109618 and CVE-2026-109619. Each is rated 9.2 on the CVSS v4.0 scale and can let an unauthenticated attacker run code on a web server, before any application code executes. The flaws sit in PHP’s core request handling, so websites built on WordPress, Drupal or Joomla are all exposed. Emergency fixes were released on October 21, 2026.
If it runs an unpatched version and serves web traffic, yes. Updating to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restarting every PHP worker is the only complete fix. PHP 8.1 and older get no new release, only source backports. Disabling the session.upload_progress feature is a stopgap, not a cure. Previously exposed systems should also be checked for signs of compromise, since patching does not undo an intrusion.
Because of scale and timing. PHP powers roughly 70% of identifiable websites, Palo Alto Networks counts 22.6 million exposed instances, and the flaws were probed in the wild on October 17 — four days before the fix — while still under embargo, then leaked publicly on October 20. Reuters described ‘millions of hacking attempts.’ The incident also marks the first major flaw found with AI-assisted auditing, changing how fast such bugs surface.
