All Kenyan ministries, departments and agencies have been ordered to hunt down systems running PHP and patch two critical vulnerabilities after the State Department for ICT and the Digital Economy issued an urgent cybersecurity advisory.

The two flaws each carry a CVSS rating of 9.2, which places them in the critical risk category. The department said its directive applies to websites, web applications, servers and any other systems built on the scripting language, with internet-facing platforms and critical digital service platforms to be handled first.

Administrators were told to be ready to install official security updates as soon as they are released, and to confirm which versions are affected and which fixes apply by checking PHP’s own guidance and vendor advisories before deploying anything. The PHP security team had scheduled updates for release on October 21, according to the department. The advisory does not state the year of that release.

Institutions are also required to establish whether third-party applications, hosting platforms and managed services rely on vulnerable PHP components. Where that applies, they must engage hosting providers, software developers and other service providers to confirm whether their systems are affected, establish plans to address the flaws and obtain assurances that the affected components have been secured.

The advisory says administrators should review web server, application, endpoint and network logs for signs of compromise. It lists unusual requests and unauthorised access among the indicators, alongside unexpected file changes and suspicious processes. Any suspected or detected breach must be reported promptly through government cybersecurity channels, with incident response procedures activated and relevant logs and evidence preserved.

Agencies were further directed to tighten web application firewall rules, access controls and other security measures. Where an internet-facing system cannot be secured quickly, the advisory advises restricting external access or taking it offline temporarily, in coordination with service owners. It cautioned that such temporary measures are not a substitute for installing the official updates.

ICT directors and system administrators are to prioritise their response according to how exposed a system is and how important the service it supports is. They are expected to keep records of the steps taken and escalate unresolved high-risk exposures through established government ICT and cybersecurity coordination channels. Institutions that cannot implement the required measures immediately must document outstanding risks, the protective controls already in place and timelines for addressing the vulnerabilities.

The ICT Authority said it will coordinate technical guidance and support to help government institutions identify potentially affected systems, close the vulnerabilities and track how the recommended measures are being implemented.

All government institutions are required to treat the advisory as urgent and to put in place the technical and administrative measures needed to protect state websites, information systems and digital public services.