The Ministry of Information, Communications and the Digital Economy issued a critical cybersecurity advisory on October 21, 2026 directing all ministries, departments and agencies to secure any website or web application that runs PHP.
The advisory, released through the State Department for ICT and the Digital Economy and the ICT Authority, classifies two newly disclosed flaws – CVE-2026-109618 and CVE-2026-109619, referred to as php2shell – as critical, each receiving a CVSS rating of 9.2.
Agencies must identify all PHP-based sites, including those hosted by third-party providers, determine which installations are affected, verify the appropriate fixes against official PHP guidance and apply the updates as a priority.
Where an immediate patch cannot be applied, the directive requires agencies to restrict external access or take the affected system offline and to review web-application, endpoint and network logs for signs of suspicious activity.
The ICT Authority will coordinate technical guidance, monitor compliance and support ICT directors and system administrators in documenting remediation actions, escalating high-risk exposures and recording any residual risk where patching is delayed.
The vulnerabilities affect PHP versions 5.4 and later and could enable remote code execution through memory-handling errors; the PHP project has released fixes for supported branches – PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 – which agencies must install.
Cloudflare reported seeing exploit attempts against its customers on the day of disclosure and deployed web-application firewall protections for php2shell, while the US National Security Agency also urged organisations to update immediately or disconnect vulnerable systems.
The PHP Foundation noted an early indication of one flaw in 2024 and described the delay in addressing it as a structural failure, underscoring the urgency of the Kenyan advisory.
The directive highlights challenges for agencies that rely on legacy applications or outsourced hosting, as they must work with developers and service providers to locate and remediate vulnerable PHP installations.
