The temporary shutdown of government and public-facing websites across multiple countries last week was not the result of successful cyberattacks. Rather, it was a deliberate response to the discovery of two critical vulnerabilities in PHP, a web technology that powers a significant portion of the internet. According to Sumsub, a leading AI-powered trust infrastructure for compliance operations at scale, the vulnerabilities have already triggered millions of attempted exploitations worldwide, prompting organisations to move swiftly to secure their systems.
The scale of the response demonstrates just how interconnected today’s digital ecosystem has become. Because PHP underpins many popular websites and services, a vulnerability in the underlying technology can have far-reaching consequences across governments, businesses and public institutions.
While governments and organisations in Europe and Asia publicly disclosed precautionary website shutdowns, relatively few similar announcements have emerged from Africa. South Africa’s Presidency was among the most prominent institutions on the continent to acknowledge temporarily restricting access to online services as a precautionary measure.
What makes this incident noteworthy is not merely the vulnerability itself, but the speed of the global response. Security providers reported a surge from thousands to millions of attempted attacks within hours of the flaws becoming public, highlighting how quickly cybercriminals move to exploit newly disclosed weaknesses.
The incident also provides a glimpse into the evolving role of artificial intelligence in cybersecurity. Researchers used advanced AI systems to help identify vulnerabilities that had remained undiscovered for years, demonstrating both the opportunities and challenges presented by increasingly powerful technologies.
Commenting on the impact of AI on the cybersecurity landscape, Mick Amelishko, AI Advocate at Sumsub, said:
“PHP2Shell won’t be the last incident like this. Frontier AI models now find and weaponise decades-old flaws in days, so we should expect more of them and faster.”
While no organisation welcomes service disruptions, the global response demonstrates an important shift in cyber resilience, where preparedness and rapid response are becoming as important as prevention. Reflecting on the lessons emerging from the incident, Mick Amelishko added:
“Cybersecurity is no longer solely about preventing attacks. It is increasingly about resilience, preparedness and the ability to respond rapidly when vulnerabilities emerge. In an environment where threats can spread globally within hours, having the capability to isolate systems, apply updates and maintain public trust may be just as important as preventing breaches in the first place.”
“From now on, every product needs a tested plan to isolate affected services and ship a patch within hours, and teams need to attack their own systems before someone else does. Engineering and product organisations should be measured not just on what they ship, but on how resilient they are when the next incident hits.” concluded Amelishko
The global response to the PHP vulnerabilities serves as a reminder that cybersecurity is a shared responsibility, requiring organisations to remain alert, adaptable and ready to act when new risks emerge.
