Yves Kanda, Enabler Technologies.
When a serious flaw in PHP, the code behind a large share of the world's websites, came to light on 20 October 2026, Enabler Technologies (www.enablr.tech) didn't host a single customer website. By the end of the week, we did. Here's how a 4:30 am text turned an internal check into a conversation our customers and most of the world weren't prepared for.
Was it "our problem"?
Honestly, at first, it was an internal question. When news of the PHP flaw broke this week, my first thoughts were the selfish ones. Does this touch our own website? Is anything we run internally exposed?
A few texts went back and forth. The answers came back clean, and I was reasonably comfortable switching off for the evening. We had nothing to worry about. I genuinely didn't lose any sleep.
Until about 4:30 the next morning. One message had been sitting behind my phone's do not disturb. It asked a simple question: even if we don't have a problem, isn't this a conversation our customers would expect us to have with them? Were they even aware?
That's the moment the week changed. We don't build or host websites. But our customers don't separate their tech into neat boxes. To them, it's all "the IT". If something bad happens to their website, it lands on their bookings, their enquiries and their reputation, and nobody cares whose job it technically was.
What did we actually do?
We ran courtesy checks on our customers' public websites. Nobody asked us to, and nobody was paying for it. It just felt like what someone in your corner should do.
Most came back clear. Three didn't: a venture capital firm, a hospitality business and an events company. And with that, the race for information started all over again.
What was the hardest part?
Not the flaw. Information about the vulnerability was everywhere within hours. The hard part was getting into the affected websites themselves.
Who actually controls the site? Who has the login? Where is it hosted, and whose name is on the account? Those questions should take minutes to answer. They took far longer.
Here's what we learned: web developers often don't keep records, and in our experience, the less you paid for your website, the more likely you are to find yourself held to ransom by whoever built it. Not by criminals. By the simple fact that one person holds the keys and you don't.
If you can't get into your own website quickly on a quiet Wednesday, imagine trying during a real attack.
Is AI making this worse?
Yes and no. AI is a genuinely useful tool, and it's useful to everyone, to the do-gooders and the ne'er-do-wells alike. The same tools that help a business write better, work faster and serve customers better also help criminals find weaknesses faster and write more convincing scams.
AI has sped up everything else, and it has sped this up too. A CTO quoted by Business Insider expects more flaws like this one to surface in the coming months. We agree. This won't be the last October like this.
That's why awareness is going to be critical for every business from here on. Your website, your email and your systems hold your customers' details, and your customers trusted you with them. Knowing what you run, who controls it and who is watching it is no longer an IT question. It's a business one.
Why does this matter to a business owner?
Because the scariest risks are the ones that fall between the cracks. Your IT partner looks after your network. Your web developer built your site three years ago and moved on. Your hosting company keeps the server running but doesn't check what's on it. Everyone is doing their job, and nobody is watching the whole picture.
It also isn't personal. Attackers use automated tools that sweep the entire internet looking for websites with a known flaw. They don't check how big you are first.
How big was the PHP problem?
Big. One technology chief told Business Insider that about 70% of the internet runs on PHP, and that he hadn't slept for nearly 48 hours trying to protect his clients. He also pointed out that older versions of PHP no longer get official fixes, so older websites need someone to step in by hand.
That's the part that worries us for South African small businesses. Plenty of websites were built once and then left alone.
What should you ask about your own website this week?
Three questions to whoever built or hosts it:
- Does our website run on PHP, and which version?
- Has it been updated since 20 October 2026?
- Who is responsible for keeping it safe, by name?
If nobody can answer, that is your answer. It means nobody is watching it.
If you'd like a quick view of where your business is exposed, take our 1-minute Domain Security Check at domainsecurity.enablr.tech. We'd rather have the conversation before you need it.
Certainty is Freedom.
FAQ
What was the October 2026 PHP flaw? A serious security weakness in PHP, the programming language that runs a large share of websites, made public on 20 October 2026. Website owners were urged to update quickly.
Is a small business website really a target? Yes. Attacks are automated and sweep the whole internet. What matters is whether the flaw is there, not the size of the business.
My website is old. What should I do? Ask your developer or host whether it still gets updates. Older PHP versions no longer get official fixes, so an old site may need upgrading, protecting or temporarily taking offline.
Who should control my business website? You should. Make sure your business holds the domain, hosting account and admin logins in its own name, and that your developer is a user, not the owner.
Is AI making cyber threats worse? AI helps both businesses and criminals work faster. Expect more flaws and more convincing scams, which makes awareness and a clear owner for every system essential.
Does Enabler host websites? Yes, when it's part of looking after a customer's technology. Enabler's Concierge Service is holistic, so when a customer's website needs a safe home or some development work, as it did this week, we take care of it. Web hosting isn't something we sell on its own, though. It's one of the ways we look after the businesses that already trust us with the rest of their technology.