What happened, in plain English

Most websites are built with a tool called PHP. Think of it as the engine on a website's server that puts each page together when you visit. About 70% of websites use it, including most WordPress sites and online shops.

On 21 October 2026, researchers announced two serious flaws in that engine, found with the help of AI tools. It was like a defect discovered in a car model, not in one car. Governments, councils, banks and an airline in Europe and Asia switched some websites off while they applied the fix (Axios, Euronews).

The flaws are nicknamed PHP2Shell. In the wrong hands they could let a stranger take control of a website's server without a password. The fix was released the same day.

Kenya is directly affected. PHP runs on 82.4% of .ke websites where the technology can be identified, and WordPress runs on 84.5% of those that use a content management system (Tech-ish).

This guide explains what happened, what it means for your business or your career, and which skills stay valuable when AI can find in a week what once took a security team months.

Quick answer: is PHP still worth learning in Kenya?

Yes. PHP still runs most Kenyan websites, so businesses still need people who can build and look after them. But the job has changed. It now includes keeping software up to date, protecting customer data and checking work produced by AI tools. If you are starting out, learn web development with security built in.

When AI found hidden flaws, websites went dark

The biggest case is PHP2Shell, and it is recent. A smaller case from earlier this year shows the risk of AI-built apps.

Why AI changes the picture

The PHP flaws were not new. They had been there for over a decade. Using them required such a complicated chain of steps that very few people could manage it. AI removed that barrier: one researcher did in a week what a strong team would once have needed months to do (CNN).

AI helps both sides. OpenAI said its tool found the problem before attackers did, which gave fixers a head start (Yahoo News). But news of the flaw leaked, and attackers moved in anyway (NPR).

This does not mean PHP is weak or abandoned. Only sites running PHP on their own servers were exposed, and operators who could update quickly stayed online (France 24).

Is PHP still a good choice? Yes, if it is kept up to date

PHP today is not the PHP people joke about. It is actively developed and widely supported. But it only protects you if the fixes are actually applied.

• Still evolving: PHP 8.5 was released in November 2025 with new features for developers (Liquid Web).
• Widely used: In July 2026, PHP 8.4 was the most-used version among developers, and 8.5 had reached 16% after six months (Freek.dev).
• Strong toolkits: Laravel and Symfony, the popular frameworks built on PHP, both have 2026 releases (Pasquale Pillitteri).
• Newer is not automatically safer: One of the flaws sat in a feature found only in the newest version, so what matters is how quickly fixes are applied (Digital Applied).

Is your website on a fixed version?

Updating WordPress or its plugins does not fix this problem. The fix has to be applied by whoever manages your server, usually your hosting company.

Ask them to confirm in writing that your site runs PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a newer version. Anything older than 8.2 no longer receives official fixes and should be upgraded. PHP 8.2 itself stops receiving security fixes on 31 December 2026, so plan a move to a newer version.

Sources: Cloudswitched and Digital Applied. Confirm against php.net before you act.

What this means for Kenyan businesses, schools and startups

Kenyan businesses choose PHP for good reasons: low-cost hosting, plenty of WordPress and Laravel talent, and fast delivery of online shops and booking systems. Many local apps also take M-Pesa payments through Safaricom's Daraja, and PHP is a common choice for building them. Those same strengths mean more Kenyan sites are exposed than the world average.

• How many sites: PHP runs on 82.4% of .ke sites where the technology can be identified, and on 87.5% of sites hosted inside Kenya (WPFOSS Kenya).
• What government did: On 21 October the Ministry of ICT and the ICT Authority told every ministry, department and agency to fix both flaws or take affected systems offline. The notice gave no sign that Kenyan government systems had been targeted (ITWeb Africa).
• Who may be missing out: Small businesses, schools and local sites may never have received a warning. As of 23 October, WPFOSS Kenya could not find a public statement from any major Kenyan host confirming it had applied the fix (WPFOSS Kenya).
• Your legal duty: The Data Protection Act 2019 expects organisations to protect the personal data they hold. A site with customer details on an unfixed server is a legal risk as well as a technical one.

Kenya was already under pressure

These earlier incidents were not linked to AI, but they show how quickly a website problem becomes public. In November 2025, a coordinated attack defaced several ministry websites. In July 2026, the presidency website was defaced and a ransom of five Bitcoin was demanded (ITWeb Africa).

Three questions to ask your web host this week

1. Which version of PHP does my website run, and has it been updated to a fixed release?
2. Was the server restarted after the update, so the fix is actually active?
3. Do you provide a firewall and regular backups, and have you tested restoring them?

Using AI tools safely: a checklist for new developers and small teams

AI assistants such as Claude, Gemini and GitHub Copilot make you faster. They can also help you make mistakes faster. These habits keep your work safe.

• Never put passwords or secret keys in code that visitors can see, or in public code sites. Keep them in protected settings on the server.
• Read AI-written code before you use it. Ask the tool to explain it in plain words, and test anything that handles money or customer data.
• Treat everything people type into a form as untrusted. Use the safe features your framework already provides.
• Confirm M-Pesa payments on your server before marking an order as paid. Check the amount and the transaction record.
• Keep a list of every website and server you look after, including those run by outside hosts.
• Apply updates quickly, and restart the server afterwards. An update that has not been restarted is not yet protecting you.
• Follow official security announcements, and move off outdated software before it becomes an emergency.
• Keep backups and practise restoring them, so switching a site off for a day is a choice, not a panic.

AI can also work for you. Ask it to review your setup, then check what it tells you.

Skills that outlast any tool

PHP2Shell was a flaw in the foundation, underneath every website built on it. That is the lesson for anyone starting a tech career in Kenya: tools and trends change, but these skills keep their value.

• How websites work: what a server does, where a site is hosted, and why updates matter.
• Data and privacy: what you store, who can see it, and how you recover it.
• Safe habits: protecting passwords, checking what users submit, and handling payments carefully.
• Good judgement: reviewing what AI writes and knowing when it is wrong.
• Real projects: building and maintaining something people use, such as an M-Pesa-enabled shop or a booking system.

AI will not replace people who can do these things. It will replace people who cannot check its work.

Start building at Eldohub Tech & AI Academy

Stop chasing headlines and start building. At Eldohub Academy in Eldoret, you can learn full-stack software engineering and backend programming with a focus on real projects, practical security habits and the way Kenyan businesses actually work. Visit the Eldohub Academy website to see current programmes and register your interest.

Frequently asked questions

What is PHP2Shell?

PHP2Shell is the nickname for two serious security flaws in PHP, the software behind most websites. They could let an attacker take control of a website's server without a password. Their official codes are CVE-2026-109618 and CVE-2026-109619.

Is PHP dead?

No. PHP still runs about 70% of websites, and the flaws were fixed within hours of being announced. The lesson is to keep PHP updated, not to abandon it.

How do I know if my website is affected?

If your site is built with PHP or WordPress, it may be. Ask your hosting company which PHP version your site runs. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or anything newer. Older versions no longer get official fixes.

Do I need to update WordPress?

Updating PHP is what matters. WordPress.org said no WordPress update is required, because the flaws are in PHP itself (ESEOSpace). Ask your host to update PHP.

Was any Kenyan website hacked through PHP2Shell?

As of 23 October 2026, WPFOSS Kenya found no reports of a Kenyan site hacked or taken offline because of it. Check again, because attacks were still being reported worldwide.

Should I take my website offline?

Security agencies advised updating immediately, and switching a site off only if it cannot be updated (The Star). Update first if you can.

Is PHP worth learning in Kenya in 2026?

Yes, as part of broader web skills that include security, data handling and the ability to check AI-written code.

Sources

As of 27 October 2026. Figures and events are drawn from the pages below.

• Axios: how AI exposed the PHP flaws
• Euronews: websites go dark after AI exposes major programming language flaw
• ABC7: websites shut down globally as operators address the flaw
• CNN: PHP2Shell and the AI inflection point
• France 24: government and corporate websites go dark
• NPR: the race to save PHP2Shell
• Cybernews: 32.5 million PHP services remain vulnerable
• ITWeb Africa: Kenya security alert on PHP flaws
• ITWeb Africa: Kenya restores presidential website
• Tech-ish: PHP update or go offline
• WPFOSS Kenya: what Kenyan businesses must do
• Cloudswitched: fixed versions and end-of-life PHP
• Digital Applied: PHP2Shell patch guide
• Freek.dev: PHP version stats, July 2026
• Liquid Web: latest PHP versions
• Wikipedia: Moltbook