South Africa’s Presidency temporarily took its website offline after a major cybersecurity alert prompted organisations around the world to secure systems running PHP.

According to Daily Maverick, the Presidency said on Friday, 23 October that the website was unavailable as a “precautionary measure” in response to a global cybersecurity event.

The Presidency did not initially announce when the site would return or say that its systems had been breached.

Two Critical PHP Flaws Identified

The global alert centres on two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619.

The PHP Foundation says both flaws can, under certain conditions, allow an unauthenticated attacker to execute code on a server. It released patched versions of PHP on 21 October and urged users to update immediately.

The vulnerabilities were rated critical before the updates were released.

Websites Taken Offline Worldwide

The Presidency was not alone in taking precautionary action.

Reuters reported that government, school and hospital websites in several countries were taken offline while administrators installed fixes and assessed their exposure.

The UK’s National Cyber Security Centre advised organisations that could not immediately update or mitigate vulnerable systems to consider taking them offline until they were secured.

WordPress Issues Urgent Warning

WordPress also urged website owners to update PHP as soon as possible because of the severity of the vulnerabilities.

It stressed that the security problem is not a WordPress vulnerability itself. Instead, it affects servers hosting PHP applications, including those running WordPress.

PHP is widely used to generate dynamic website content and run backend functions, making the issue relevant to a large range of online services.

No Presidency Breach Confirmed

Daily Maverick reported that the Presidency website remained inaccessible several hours after the announcement.

However, the available information indicates that the shutdown was precautionary. No confirmed compromise of the Presidency website had been publicly announced at the time of reporting.

The global response continues to focus on installing the patched PHP versions and monitoring systems for suspicious activity.