Over the past few weeks we’ve been working behind the scenes on two things that matter to everyone who uses The Business Directory: speed and security. Here’s a quick update on what’s changed, plus an important public service announcement for any business that runs its own website.
A faster, more responsive directory
We’ve rolled out a round of performance improvements across the directory. You should notice faster searches, quicker-loading listings and a smoother experience when managing your business profile.
If you’re a listing owner, that matters for you too: a faster directory means potential customers are more likely to stay, browse and find your business.
PHP2Shell: a critical security flaw – and we’ve patched it
On 20 October 2026, details leaked of two critical vulnerabilities in PHP – the programming language that powers WordPress and a large share of the world’s websites. Tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed “PHP2Shell”, both are rated 9.2 out of 10 for severity. They allow an attacker to run their own code on a web server without needing a password.
The PHP project released fixes on 21 October 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Attackers moved quickly: security researchers observed exploitation in the wild, and on 26 October the US Cybersecurity and Infrastructure Security Agency (CISA) added both flaws to its catalogue of actively exploited vulnerabilities.
The Business Directory was patched as soon as the fixes became available. Your account, listings and data are protected against these vulnerabilities, and there’s nothing you need to do on our site.
PSA: Is your own website patched?
Here’s the part that matters for your business. PHP2Shell is a flaw in the server software itself, not in WordPress, your theme or plugins, or your custom PHP applications. That means updating your website will not fix it – the PHP running on your server has to be updated.
If you’re on shared or managed hosting
Good news: most reputable hosts moved fast. Locally and internationally, providers reported the following:
- Xneelo put mitigations in place before the official patches were out, says its web application firewall blocked a known published exploit, and applied the updates across all its hosting servers once they were released.
- Afrihost took proactive steps before official advisories were published and patched its managed and shared servers. Axxess issued the same notice to its customers.
- 1-Grid notified customers, began applying security updates across its environment and recommends PHP 8.3 or higher where compatible.
- Most international hosts also rolled out mitigations and patched PHP across their managed platforms.
Even so, it’s worth a quick check. Log into your hosting control panel, confirm which PHP version your site uses, or simply ask your host’s support team whether your server has the PHP2Shell patch. Note that some hosts apply the fix without changing the visible version number, so asking is the surest way to know.
If you run a VPS, dedicated server, cloud instance or custom setup
This is where the real risk lies. Hosting companies patch the servers they manage. If you (or a developer) manage your own server, Docker containers or a custom application, nobody will patch it for you. You or your developer should:
- Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or apply your operating system vendor’s patched packages) and restart PHP.
- Rebuild any Docker images or containers so they pick up the patched PHP base image – an old image stays vulnerable until it’s rebuilt.
- Plan an upgrade if you’re on PHP 8.1 or older. These versions no longer receive official releases.
- Check the web-facing PHP, not just the command line – they’re sometimes different installations.
PHP has also disclosed a separate, lower-risk issue (CVE-2026-115560) that only affects unusually configured sites. A fix is due in its next regular release; in the meantime, the PHP team’s recommended mitigation is to disable the session.upload_progress setting. Your host or developer will know whether this applies to you.
Patched? Check you weren’t hit before the fix
Exploitation attempts were spotted days before the vulnerabilities became public, so a patch protects you going forward but doesn’t undo any earlier intrusion. As a precaution:
- Review your website’s administrator accounts and remove any you don’t recognise.
- Look for unfamiliar plugins, extensions or recently modified files, especially in upload folders.
- Change admin, hosting and FTP passwords if anything looks off, and enable two-factor authentication.
- Update your CMS, themes and plugins to their latest versions as general good practice.
Also be wary of emails claiming to be from your host about this vulnerability that ask you to click a link and log in – scammers are known to exploit high-profile security news for phishing.
Why keeping your website patched matters
It’s easy to think “who would target my small business site?” The truth is that attacks like this are automated. Bots scan the entire internet for vulnerable servers within hours of a flaw going public, and they don’t care how big your business is. An unpatched site can lead to:
- Stolen customer data – contact forms, orders and user accounts. Under POPIA, businesses must take reasonable steps to secure personal information and must notify the Information Regulator and affected people if it’s compromised.
- Malware and spam – hacked sites are used to host phishing pages, inject spam links or infect visitors.
- Lost search visibility – Google can flag compromised sites with security warnings, sending your traffic and rankings off a cliff.
- Downtime and recovery costs – cleaning up after a breach almost always costs more than prevention.
- Damaged trust – customers remember the business whose website warned them about malware.
Regular updates, a host that responds quickly to threats, and someone keeping an eye on your site are the simplest, cheapest insurance you can buy.
Need a hand with your website?
If you’re not sure whether your site is patched, or it’s simply time for an upgrade, our hosting partner Semantica Digital can help. From security updates and managed hosting to full website rebuilds and kick-ass e-commerce stores, they’re the team that keeps The Business Directory fast and secure.