On October 20, security researchers confirmed something that should worry anyone who has ever built a website, called it finished, and never thought about it again.
Two critical flaws, now nicknamed PHP2Shell, were sitting inside PHP itself, the language running underneath roughly seven out of every ten websites on earth. Not a careless plugin. Not a shortcut some freelancer took to hit a deadline. The engine. WordPress runs on it. So does most of the content management software Ugandan businesses were sold a few years ago and have not opened since the day it went live.
The bug was found by the good guys first
Here is the part most coverage of this story skims past. CVE-2026-109618 and CVE-2026-109619 were not discovered by a criminal. They were found by a security firm called Calif, working with an OpenAI model, and later joined by Google's own Wiz team. Researchers quietly confirmed the exploit chain worked against WordPress and Drupal sites months before anything became public. OpenAI described the gap between finding a flaw and someone weaponising it as a "Defender's Window," the idea that AI can hand the fix to the builders before it hands an opening to the attackers.
That part is genuinely good news. It is also where the lesson for a Ugandan business owner actually begins, not ends.
The PHP Foundation shipped an emergency, out-of-cycle patch on October 21 at 2pm UTC, rated both flaws 9.2 out of 10 on the latest severity scale, and said plainly that no workaround existed outside of applying it. Nineteen minutes later, the security firm watchTowr was already watching live attempts to exploit the flaw. Amazon's own threat intelligence team caught separate attempts, through a network of fake servers built to look like real, unpatched ones.
Nineteen minutes between "the fix exists" and "someone is already trying the door."
Uganda's own national cybersecurity body, CERT.UG, issued its own red-rated advisory the very next day, saying the same thing everyone else was saying: patch it, there is no other option. Monitor reported that while Kenya and the major global platforms moved quickly, Uganda's public response was quieter, and cybersecurity practitioner Wasswa Godfrey urged local website owners to check directly with their hosting providers rather than assume the patch had already reached them on its own. Days after the fix shipped, researchers at Censys found that nearly 60% of the PHP servers they could see worldwide were still running the exposed version. Not because the fix was hard to apply. Because nobody whose job it actually was had gone looking for the news.
Picture the ordinary version of this. A boutique in Ntinda had its website built two years ago by a developer who has since moved on to a job in Nairobi. The site still works. It still takes orders. Underneath it, a version of PHP this exact vulnerability touches is still running, because nobody renewed the relationship past the final invoice. That boutique is not the unusual case. It is the default one.
The gap was never the code. It was the watching.
This is the pattern Make It Happen runs into constantly with Ugandan businesses, and it has nothing specifically to do with PHP. A business pays someone, often a freelancer, sometimes a relative who is "good with computers," to build a website. The site goes live. Everyone moves on to the next thing. Nobody is actually assigned to notice the next CVE number, the next emergency patch, the next ordinary Tuesday when the thing holding the site together needs five minutes of attention before it becomes the reason a customer's details walk out the back door.
A boda rider does not wait for the engine to seize before he changes the oil. He changes it on a schedule, whether the bike feels fine or not, because waiting for a problem to announce itself is how you end up pushing it home. Most Ugandan business websites run the opposite way. Built once. Never serviced. Trusted simply because nothing has visibly broken yet.
PHP2Shell is not really a story about clever hackers. The flaw was caught by the people trying to protect the internet, not the people trying to break it. A fix existed within a single day. The actual damage, wherever it eventually lands, will happen entirely on the maintenance side, in the gap between a patch existing and somebody applying it.
That gap is where real software work lives. Not in the build. In the watching.
If your business runs a WordPress site, a booking system, an online store, anything with code quietly working underneath it, there is one question worth answering honestly this week: who checks for this, and how fast do they move once they find it. If the honest answer is nobody, you don't have a website. You have a door that happens to still be standing, unlocked, simply because no one has pushed on it yet.
Software was never something you buy once. It is something you keep.
