Kenya Government Orders Agencies to Patch Critical PHP Vulnerabilities

The Ministry of Information, Communications and the Digital Economy issued a critical cybersecurity advisory on October 21, 2026 directing all ministries, departments and agencies to secure websites and web applications that run PHP.

The advisory, issued through the State Department for ICT and the Digital Economy and the ICT Authority, flagged two critical vulnerabilities – CVE-2026-109618 and CVE-2026-109619, known as php2shell, each with a CVSS score of 9.2.

Agencies are instructed to identify PHP installations, especially those accessible from the internet, verify the appropriate fixes against official PHP guidance and apply the updates as a priority.

Where immediate patching is not possible, the advisory orders agencies to restrict external access or take the affected systems offline and to document residual risks and compensating controls.

The ICT Authority will coordinate technical guidance, support and monitoring of implementation across government institutions.

The advisory also requires review of web-application, endpoint and network logs for suspicious activity and recommends using web-application firewalls as supplementary protection.

Cloudflare said it deployed web-application-firewall protections for php2shell on October 21 and observed attack traffic targeting its customers, including payloads modified to evade detection.

The US National Security Agency urged organisations running vulnerable PHP systems to update immediately or, if that is not feasible, to take the systems offline.

The US Cybersecurity and Infrastructure Security Agency said it had not observed exploitation of the specific vulnerabilities at the time of its statement but warned that unpatched systems remain at risk.

The PHP project released fixes for supported branches – PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 – and noted that the flaws affect PHP versions 5.4 and later.

“All Government institutions are required to treat this advisory as urgent and ensure that the necessary technical and administrative measures are undertaken to safeguard Government websites,” the ministry said.

“Temporary protective measures should not be treated as a substitute for applying the official security updates,” the advisory added.

No Kenyan government or business websites have been reported hacked or taken offline following the advisory.