Government websites, hospitals and other online services have been taken offline following the discovery of critical security vulnerabilities. But beyond the immediate cyber security concerns, this incident raises a much bigger question for businesses: if your technology suddenly became unavailable, how quickly could you recover?
On 21 October 2026, organisations across Europe temporarily took websites and online services offline following the discovery of two critical vulnerabilities in PHP, a programming language used extensively across the internet.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, were assessed as critical, with the potential to allow attackers to execute malicious code on vulnerable systems.
Government departments, public services and other organisations responded by taking precautionary action while security updates were made available and installed.
Importantly, many of these shutdowns were preventative measures rather than evidence that the organisations had suffered a successful cyber attack.
Nevertheless, the disruption provides an important reminder of just how dependent modern organisations have become on technology. And perhaps more importantly, how quickly that technology can become unavailable.
Cyber Security Is Only Part of the Conversation
When a major software vulnerability makes the news, the immediate conversation understandably focuses on cyber security.
What went wrong? Which systems are vulnerable? Has anyone been compromised? How quickly can the problem be fixed?
These are important questions, but they're not the only ones business leaders should be asking.
What happens when a critical system needs to be taken offline?
What happens when employees cannot access the applications they depend on?
What happens when customers cannot use your website, place orders or access essential services?
And what happens when the disruption lasts longer than expected?
This is where cyber security becomes a business continuity issue.
Protecting technology is essential, but organisations also need to understand how they would continue operating when that technology is unavailable.
The PHP incident demonstrates that downtime doesn't always begin with a successful cyber attack. Sometimes, taking systems offline is the responsible decision to prevent a much more serious problem.
The challenge is whether the organisation is prepared for the consequences.
Having Backups Doesn't Mean Your Business Can Recover
One of the most dangerous assumptions a business can make is that having backups means everything will be fine.
Backups are an essential part of protecting business information, but they are only one component of an effective recovery strategy.
There is a significant difference between having a copy of your data and being able to restore your business operations.
Consider a business that loses access to a critical application.
Its data might be backed up securely, but how long will it take to restore the application itself? Will employees be able to access the restored system? Are the necessary configurations, integrations and permissions available? What happens if the original infrastructure cannot be used? And has anyone actually tested the recovery process?
A backup that has never been tested creates uncertainty. Even a successful data restoration may leave a business unable to operate normally while systems are rebuilt, connections are re-established and services are verified.
The question isn't simply whether your business has backups. It's whether you know how long recovery would take and what that recovery would involve.
For some organisations, a few hours of disruption might be manageable.
For others, the same period could interrupt customer services, delay transactions, affect employees and create significant operational problems.
Understanding that difference is essential.
Business Continuity Is a Leadership Responsibility
It's easy to think of technology failures as something for the IT department or external IT provider to manage. But the consequences of downtime extend far beyond technology.
They affect employees, customers, finances, reputation and the organisation's ability to deliver its services. That makes business continuity a leadership responsibility.
An IT provider can recommend safeguards, maintain systems, manage backups and support recovery. However, business leaders must understand which operations are critical and how much disruption the organisation can reasonably tolerate.
For example, if a business cannot operate without its customer management system, leadership needs to establish how quickly that system must be restored.
If a website generates most of the organisation's revenue, there needs to be a clear understanding of what happens when it becomes unavailable. These are business decisions informed by technical advice. They should not be left until an incident is already unfolding.
Directors don't necessarily need to understand every technical detail of their IT infrastructure. But they should understand what happens to the business when that infrastructure fails.
Recovery Needs to Be Planned, Not Assumed
An effective recovery strategy begins long before a system goes offline.
It requires organisations to identify their most important systems, understand the impact of losing them and establish realistic recovery expectations.
Two particularly important considerations are how much data the business can afford to lose and how long critical systems can remain unavailable.
These are often described as the Recovery Point Objective (RPO) and Recovery Time Objective (RTO).
For example, a business might decide that it cannot afford to lose more than one hour of transaction data and that a critical application must be restored within four hours.
Those objectives then help determine what backup arrangements, infrastructure and recovery processes are required.
But defining objectives is only the beginning.
Recovery arrangements need to be tested.
Testing helps establish whether backups can be restored, whether systems function correctly afterwards and whether the organisation can realistically meet its recovery expectations.
Without testing, recovery times can become little more than assumptions.
And assumptions are not a reliable business continuity strategy.
It's Time to Challenge Your IT Provider
The recent PHP vulnerabilities are a timely reminder that even widely used, established technologies can develop serious security problems.
Organisations need IT partners who understand that protecting a business means preparing for disruption, not simply responding to technical faults.
If you're a business owner or director, now is a good time to have a conversation with your IT provider.
Ask them:
When were our backups last successfully tested?
How long would it realistically take to restore our most important systems?
Which business applications would be prioritised during recovery?
What happens if our website, cloud platform or main server becomes unavailable?
Who is responsible for making decisions and communicating with employees during an incident?
Are our recovery arrangements documented, and have they been tested against a realistic scenario?
These aren't unreasonable questions.
They're fundamental to understanding whether your organisation is prepared for disruption.
A proactive IT provider should be able to explain the recovery arrangements in place, identify potential weaknesses and help you understand what improvements may be necessary.
If the answers are unclear, that uncertainty is itself something worth addressing.
The Real Lesson From the PHP Security Incident
The discovery of critical PHP vulnerabilities has prompted organisations to act quickly to protect their systems.
For some, that has meant temporarily removing services from the internet while the necessary security work takes place.
Those decisions highlight an important reality: even with strong security measures, disruption cannot always be avoided.
What businesses can control is how prepared they are to respond.
That means understanding their technology, maintaining appropriate security measures, testing recovery processes and ensuring business leaders have a clear view of the risks.
At Sunrise Technologies, we believe proactive IT support should help organisations prevent avoidable problems while preparing them for the challenges that cannot always be predicted.
Because business resilience isn't measured solely by how well you prevent an incident.
It's also measured by how effectively your organisation can recover when something goes wrong.
Does Your IT Provider Have a Recovery Plan for Your Business?
If you haven't recently discussed business continuity, backup testing or recovery times with your IT provider, now is the time.
At Sunrise Technologies, we help businesses understand their technology risks, strengthen their operational resilience and take a more proactive approach to IT management.
Our Business IT Risk Assessment is designed to help organisations consider important areas of technology, cyber security, risk management and operational resilience.
Start by understanding where your business stands. Complete our Business IT Risk Assessment or speak to the Sunrise Technologies team about your recovery arrangements.
