Job Angula
If your organisation runs a website, customer portal, e-learning platform, staff webmail or online business system, there is a security question your IT team needs to answer today. Your IT team may already know. Your board probably does not.
On 20 October, news of two critical security flaws in PHP, software behind much of the world’s web infrastructure, emerged ahead of a planned security update.
On unpatched systems, the flaws could let an outsider take control of a server without a password. Within a day, technical details were circulating and an emergency fix had been released. International security firms warned that criminals would start attacking unpatched systems within minutes.
This is not only an IT matter. A compromised system can become the front door to customer records, payment systems and internal email. That makes it a question of money, reputation and trust, which is to say a question for the people in charge.
What is PHP, and why should a CEO care?
Think of a website as a shop. The shopfront, the shelves and the signage are what customers see. Behind the counter, though, most shops run on one of a handful of makes of till, the machine that takes orders, looks up stock and handles the money.
PHP is the most widely used of those tools on the internet. It is the hidden engine that runs roughly seven out of ten websites in the world, including popular platforms such as WordPress, Drupal and Magento.
It also runs many systems the public never sees, such as e-learning platforms like Moodle, webmail, file-sharing tools, customer databases and the admin tools IT teams use to manage them. Most leaders have never heard of it, because nobody sees it. That is exactly why it matters.
This week, the world learned that this till has had a faulty lock for years. Researchers say some of the underlying weaknesses have been hiding in PHP for more than a decade. Anyone who knows the trick can now open it from outside, and the trick is circulating.
Why this lands close to home
Namibia does not need imported examples of what a breach costs. In December 2024, criminals took about 626GB of data from Telecom Namibia, in what has been called the largest breach in the country’s history.
In March 2026, the Namibia Airports Company suffered a ransomware attack, with attackers reportedly accessing approximately 500GB of information.
In September, a criminal group claimed an attack on the Namibian Defence Force. None of those incidents has been linked to this PHP flaw. But they show how attackers already treat Namibian institutions: as worthwhile targets.
The national numbers point the same way. NAM-CSIRT, the country’s cyber response team at CRAN, detected 513 921 vulnerabilities between April and June 2026, up almost 40% on the previous quarter.
It said the rise was driven largely by exposed and outdated systems, and urged organisations to install security updates promptly.
The ITU’s 2024 global index scored Namibia’s cyber readiness at 37.93 out of 100.
In plain terms: we are digitising fast, and our defences have not kept pace.
The real danger: systems nobody is looking after
The fix released this week only works for recent versions of PHP.
Older versions no longer receive repairs from the people who make the software, much like a car model the manufacturer has stopped making spare parts for.
Worldwide, that is a large part of the problem.
An analysis by VirusTotal found that, among internet-facing systems revealing their PHP version, roughly 758 000 were running versions no longer maintained by the PHP project, compared with 272 000 on supported versions.
Some operating-system vendors still supply their own fixes for older versions, but only to customers on those support arrangements.
Many organisations, here and elsewhere, run old versions because a website was built once by a contractor and never touched again.
A second shift should worry leaders. Security researchers at Wiz said this flaw sat unnoticed for decades because exploiting it was too complicated for most people. Modern AI tools, they said, greatly lowered that barrier.
The old comfort that “nobody would bother attacking us” no longer holds when attacks become cheap to build. The size of your organisation is no longer a reliable measure of how likely you are to be targeted.
Criminals can increasingly automate the search for weaknesses, whether the target is a multinational or a small Namibian business.
Five questions to ask your IT team before Friday
A board cannot manage a digital risk it has never asked management to identify. An executive does not need to understand the technology to lead on this. You need to ask the right questions and expect clear answers.
1. Do we use PHP anywhere? Not just the public website: include customer portals, staff email, e-learning and file-sharing tools, internal HR or billing systems, and anything a supplier or web agency built for us. Internal systems count too, if they can be reached from the internet.
2. Have those systems been updated with this week’s fix?If yes, when. If no, what is the date, and who is responsible.
3. Are any of our systems too old to receive the fix? If so, can they be taken offline or shielded until they are replaced?
4. Who looks after the sites our suppliers host for us? A website built by an agency in 2017 is still our risk, and our name in the headlines.
5. If we were breached tonight, who would know, and who would we call? That includes reporting to NAM-CSIRT.
If the answers are vague, that is your answer. The organisation does not have enough visibility over its own digital front doors.
The cost of a phone call
Most of the immediate risk from these flaws can be reduced by applying security updates or temporarily protecting vulnerable systems.
But the larger issue is whether an organisation knows what it runs, who maintains it and how quickly it can respond when something goes wrong. That is not simply a technical question. It is a leadership question.
The next serious cyber incident in Namibia may not begin with a sophisticated attack on a well-defended institution. It may begin with an old website, an overlooked server or a system nobody realised was still running.
Before Friday, pick up the phone to your head of IT. Ask what is exposed, what has been fixed and what remains at risk. The most expensive answer may be that nobody knows.
*Job Angula is a technology risk and governance professional and the author of Digital Namibia: From Paper to Progress.
