Ministry of ICT Issues Urgent Cybersecurity Alert Over PHP Flaws

State Department of ICT and Digital Economy John Tanui

The government has issued an urgent cybersecurity alert to public institutions over two critical vulnerabilities affecting PHP-powered systems. The flaws could expose government information and online public services to attacks if administrators fail to secure affected systems.

The State Department for ICT and the Digital Economy, working with the ICT Authority, issued the advisory to government agencies. Institutions were directed to identify potentially affected systems and prepare to install security updates released by the PHP security team.

Both vulnerabilities received scores of 9.2 under the Common Vulnerability Scoring System (CVSS), indicating a critical security risk. According to the advisory, attackers could exploit the flaws to execute malicious code remotely on vulnerable servers.

Government Directs Agencies to Identify Vulnerable Systems

The advisory warned that widespread PHP use could expose government digital infrastructure to serious security threats. It said the vulnerabilities could affect the confidentiality, integrity and availability of government information systems and online public services.

PHP supports websites, web applications and digital platforms used by organisations to deliver services online. A successful attack could allow criminals to interfere with affected servers, potentially compromising information or disrupting essential digital services.

The security updates were scheduled for release on October 21, 2026. Government administrators were urged to consult official PHP security announcements and software vendor advisories to identify affected versions and appropriate fixes.

Institutions were instructed to prioritise internet-facing websites, web applications, servers and other systems running PHP. These systems require particular attention because they are accessible externally and could provide attackers with an entry point.

Agencies were also directed to examine third-party applications, hosting platforms and managed services for vulnerable PHP components. The government wants institutions to consider the entire technology environment rather than checking only software they manage directly.

Agencies Told to Apply Security Updates Immediately

Administrators were instructed to verify the applicable fixes and affected software versions before installing the updates. Once the relevant security patches became officially available, institutions were expected to apply them immediately.

The advisory also addressed institutions that could not secure exposed systems quickly enough. Such organisations were advised to restrict external access or temporarily take affected services offline until effective protection could be implemented.

However, agencies were told to coordinate these decisions with the owners of affected services. This approach aims to reduce cybersecurity risks while limiting unnecessary interruptions to government operations and services relied upon by the public.

Taking a vulnerable website offline could affect access to certain digital services temporarily. However, leaving an exposed system accessible without adequate protection could create greater risks if attackers exploited the weaknesses.

Government Warns Against Ignoring Suspicious Activity

The advisory directed institutions to examine their web server, application, endpoint and network logs for signs of possible compromise. Administrators should look for unusual requests, unauthorised access, unexpected file changes and suspicious processes.

These checks could help security teams identify attempted attacks or determine whether intruders had already accessed affected systems. Institutions were encouraged to investigate suspicious activity and respond according to their cybersecurity procedures.

The government also recommended strengthening web application firewall rules, access controls and other protective measures. Such safeguards can help reduce exposure while institutions complete the necessary security updates.

However, the advisory cautioned that temporary protections should not replace official software patches. Institutions must still install the relevant updates to address the underlying vulnerabilities.

The alert highlights the importance of maintaining secure software across public-sector digital infrastructure. Government agencies will need to identify affected systems, apply the fixes and monitor their networks to reduce the risk of potential breaches.

The advisory does not establish that government systems have already been compromised. Instead, it calls for urgent preventive action to protect sensitive information and maintain the reliability of online public services.