In Africa, 7% of Kenya's organisations are hit by PHP2Shell, with South Africa sitting at 2%.
Since details of the two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell) leaked ahead of planned disclosure, 10% of organisations worldwide have been impacted, according to new data from Check Point Research. Hourly activity peaks at midnight, when fewer security teams are watching.
Europe is the hotspot. 14% of European organisations have been impacted, more than double the rate in North America, Latin America and APAC (6% each). Africa has the lowest rate at 4%.
Commenting on the figures from an African perspective, Ian van Rensburg, Head: Security Engineering - Africa, Check Point Software Technologies, says: "Africa’s lower impact rate of 4%, compared with 14% in Europe and 10% globally, is encouraging, but we must not confuse lower exposure with stronger cybersecurity.
Several factors may explain this difference. Africa has a very different technology landscape, with varying levels of digital maturity, PHP adoption and internet-facing infrastructure across the continent. Attackers are also opportunistic. They tend to concentrate their efforts where they find the largest number of vulnerable systems and the greatest potential financial return. Europe's more extensive digital infrastructure could partly explain why it is seeing significantly higher activity levels.
Another factor worth considering is visibility. Not every attack is detected or reported, and differences in security monitoring and threat intelligence coverage can influence the regional picture. A lower recorded impact does not necessarily mean fewer vulnerabilities exist. What concerns me is the false sense of security these figures could create. Africa's digital economy is expanding rapidly, with organisations increasingly adopting cloud services, digital platforms and interconnected systems. This creates tremendous opportunities for growth, but it also expands the potential attack surface.
The lesson for African businesses is to avoid complacency. Cybercriminals don't respect geographical boundaries, and vulnerabilities can be exploited within hours of becoming public. Organisations need to understand their exposure, prioritise patching and ensure they have preventative security measures in place while vulnerabilities are being addressed.
Ultimately, Africa's lower impact today should be seen as an opportunity to strengthen our defences, not as evidence that we are somehow safer. The real test isn't how often we're targeted, but how prepared we are when we are."
Check Point Warns PHP2Shell Flaws Could Leave Organisations Exposed to Remote Attacks
Lotem Finkelstein, Vice President of Research at Check Point Software Technologies, said the threat posed by PHP2Shell lies in the severity of the vulnerabilities and the widespread use of PHP across websites, e-commerce platforms and enterprise services.
“The concern surrounding PHP2Shell stems from the combination of the vulnerabilities' severity and the widespread use of PHP, which underpins websites, e-commerce platforms, and many enterprise services,” Finkelstein said.
He warned that the two critical vulnerabilities could allow attackers to execute code remotely, while the premature disclosure of their details was giving security teams less time to prepare.
Because the flaws affect the PHP engine itself, Finkelstein said updating content management systems or plugins alone would not be sufficient to address the threat.
He urged organisations to identify all systems running PHP, prioritise internet-facing servers and ensure their infrastructure could be patched quickly. He also called for additional protective measures where immediate updates were not possible, particularly for systems running unsupported versions of PHP.
“You cannot protect a system you do not know exists,” Finkelstein said, stressing the importance of maintaining an inventory of PHP instances, including those deployed in containers and third-party products.
He added that artificial intelligence was accelerating vulnerability discovery and exploitation, leaving security teams with less time to respond. Organisations should therefore prepare to deploy official updates as soon as they become available, while monitoring for suspicious activity, including web servers executing system commands, unexpected files appearing on websites and outbound connections to unknown destinations.
Charlotte Wilson, Head of Enterprise at Check Point Software Technologies, said the widespread use of PHP made the vulnerabilities a significant concern for organisations across multiple sectors.
“The scale of this is enormous. We're talking about two serious security flaws in technology that underpins around three-quarters of the internet, potentially allowing criminals to access vulnerable systems remotely without even needing a password,” Wilson said.
She noted that governments, businesses, banks and public services rely on interconnected digital systems, meaning a weakness in widely used technology could expose large numbers of organisations simultaneously.
“It's a bit like discovering that millions of buildings have been fitted with the same faulty lock. Suddenly, everyone is racing to change it before someone works out how to open the door,” she said.
Wilson also raised concerns about the growing dependence on a relatively small number of technology providers to support essential services, noting that regulators were paying closer attention to the role these companies play in critical infrastructure.
She said the timing was particularly concerning amid warnings from the UK's National Cyber Security Centre (NCSC) that artificial intelligence could increase the frequency and intensity of cyberattacks, allowing criminals to identify and exploit weaknesses more quickly.
“When governments are choosing to take their own websites offline rather than risk leaving them exposed, it gives you a pretty clear indication of how seriously this is being taken,” Wilson said.
She added that while applying security updates was the immediate priority, the incident also raised broader questions about the resilience of digital infrastructure and the risks of widespread dependence on shared technologies.