In response to the recent uncovering of two significant vulnerabilities in PHP, South Africa’s mobile network operators have stated that they are not at risk.
Vodacom, Cell C, Rain, and MTN informed MyBroadband that they either implemented quick fixes or encountered no exposure amid concerns following the leak.
The PHP vulnerabilities were disclosed on October 20, 2026, prior to any patches being available, placing thousands of Internet servers in South Africa and millions worldwide in jeopardy.
PHP serves as a widely used open-source scripting language tailored for web development and applications.
Originally standing for Personal Home Page, PHP is now a recursive acronym meaning “PHP: Hypertext Preprocessor.”
Tracked under CVE-2026-109618 and CVE-2026-109619, the vulnerabilities can allow malicious actors to execute remote code on servers, resulting in the moniker PHP2Shell.
A search via Shodan for PHP-running servers in South Africa revealed more than 9,800 connected systems, encapsulating nearly all major hosting providers in the country.
This list included Amazon Data Services South Africa, Afrihost, Xneelo, and Microsoft. Both vulnerabilities received a Common Vulnerability Scoring System version 4 rating of 9.2 out of 10.
On October 27, 2026, South Africa’s leading web hosting companies were still managing the consequences of the vulnerabilities.
Nevertheless, they relied on web application firewalls and additional measures to protect customers from potential risks.
Reports suggest that exploiting these vulnerabilities may not be as straightforward as initially perceived and a universal exploit has yet to emerge.
Moreover, while remote code execution is possible through these vulnerabilities, CrowdStrike noted that a successful exploit would only allow execution of commands within the web server user’s security context.
For complete control over a vulnerable server, an attacker would also need to discover and exploit a privilege escalation flaw.
That said, CrowdStrike indicated that the PHP vulnerabilities alone could enable credential theft, web shell installation, and lateral movement.
PHP2Shell May Have Been Exploited Before Disclosure
In related news, Amazon Threat Intelligence reported a PHP2Shell exploitation attempt occurring on October 17, 2026, four days before the vulnerabilities were publicly disclosed.
According to Amazon, “The exploit attempt originated from an IP address associated with a commercial anonymization network.”
“While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor.”
In response to the vulnerabilities, Vodacom informed MyBroadband that it promptly took steps to mitigate its risk.
“We immediately activated our vulnerability management processes and are actively assessing our environment,” said a Vodacom representative.
“We are prioritizing potentially exposed systems and implementing appropriate mitigation and patching actions according to vendor advice.”
Vodacom confirmed that it would continue to monitor developments closely and take necessary further actions.
Cell C and Rain Report No Exposure
Cell C conducted an evaluation after the disclosure and determined there was no risk of exposure within its systems, including its public-facing websites.
“To date, our assessment has found no evidence that Cell C systems have been compromised or that customer data has been affected,” the company stated.
“Cell C continuously monitors its environment using established security protocols, as safeguarding our systems and customer data is an ongoing concern.”
Rain reported that PHP did not comprise its core service infrastructure, limiting its potential exposure to the vulnerabilities.
“After the disclosure, we assessed our systems for potential risks and took precautionary measures,” Rain remarked.
“Our investigations haven’t uncovered any evidence of exploitation within Rain’s environment.”
Although MTN chose not to comment specifically, it did provide insights on how such vulnerability disclosures can impact large organizations.
“While we do not comment on specific vulnerabilities or security measures, we have processes in place to assess risks and implement necessary mitigations,” the company stated.
MTN South Africa explained that for large entities like network operators, patching requires careful management.
“Security updates must be thoroughly evaluated, prioritized, and tested to ensure they mitigate risks without adversely affecting essential systems and customer services,” the company said.
“The goal is to achieve both security and operational stability.”
Don’t miss the latest news
