Criticial PHP flaws exposed in what is being termed 'Black October'. (Photo by Boitumelo on Unsplash)
Genghis Technology is urging South African businesses to confirm with their web hosts and developers this week that their websites have been updated after the PHP project released emergency fixes for two critical security flaws.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed "PHP2Shell", were patched on 21 October 2026. Both allow an attacker to run their own code on a web server without needing a login.
PHP underpins a large share of the web, including most WordPress and WooCommerce sites and many custom business portals. Security researchers and hosting providers reported exploitation attempts on 21 October, before the fix was published, after technical details leaked a day earlier.
The disclosure is part of an unusually intense period in global cyber security, which commentators have begun calling "Black October". Alongside the PHP flaws, the past few days have brought breaches at hosting and developer platforms involving stolen credentials and exposed keys, as well as problems with a certificate provider and a long-standing flaw in a widely used software tool.
Some of the more dramatic claims circulating online remain unverified, and some researchers believe automated mass exploitation of the PHP flaws may be harder than first feared. Genghis Technology’s advice is to act on the confirmed facts rather than the headlines.
"The risk for small and mid-sized businesses is rarely the headline vulnerability itself. It is not knowing which version of PHP your website runs, or who is responsible for updating it," said Che Meer, Director of Operations at Genghis Technology. "A compromised web server can expose customer and staff information, and under POPIA that quickly becomes a legal and reputational problem as well as a technical one. The first step costs nothing: ask your host or developer which version you are on and when it was patched."
Genghis Technology recommends that businesses:
- Confirm that their sites run PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or a later release.
- Upgrade or migrate any site on a retired PHP version such as 7.4, which will not receive the fix.
- Ask their host to disable the session upload-progress setting as a temporary measure if patching is delayed.
- Change hosting, admin, database and API credentials and switch on multi-factor authentication.
- Check for unfamiliar files, new administrator accounts and unusual activity, because attacks started before the patch was available.
South African businesses face a heavy cyber burden. The Information Regulator received 1 727 security compromise reports in the 2024/25 financial year and expects nearly 2 500 in 2025/26, and large customers increasingly ask suppliers to demonstrate POPIA compliance before renewing contracts.
“Black October points to a wider truth,” says Meer. “Most attacks on small businesses don’t rely on clever new techniques. They exploit known weaknesses that already have a fix, often released weeks or months earlier. A patch protects no one until it is installed, and every day outdated software stays online gives attackers more time to find it. That applies to far more than your website: plug-ins, operating systems, firewalls, routers and the everyday apps your staff rely on all need regular attention. The businesses that cope best treat patching as a scheduled routine, with a clear owner and a simple record of what runs where. When an emergency fix like this one lands, they can act in hours, not weeks.”
Businesses can request a rapid PHP exposure review from Genghis Technology at info@genghis.tech or 010 005 4738.