PHP vulnerabilities: Government issues urgent cybersecurity warning to all state agencies

PHP vulnerabilities: Government issues urgent cybersecurity warning to all state agencies

The government warned that the flaws could allow attackers to run unauthorised code on affected systems, potentially putting government information and online public services at risk.

The government has warned of potential cyber threats to its websites and online services after identifying two critical vulnerabilities in PHP, a programming language widely used to run websites and web applications.

In a statement, the State Department for ICT and the Digital Economy directed all ministries, departments and agencies to take urgent measures to identify affected systems, apply security updates and strengthen protection against possible attacks.

According to the Department, the two vulnerabilities had each received a rating of 9.2 on the Common Vulnerability Scoring System (CVSS), placing them in the critical risk category.

The government warned that the flaws could allow attackers to run unauthorised code on affected systems, potentially putting government information and online public services at risk.

“Given the widespread use of PHP in web-based systems, these vulnerabilities may pose a significant risk to the confidentiality, integrity and availability of Government information systems and online public services,” reads the advisory.

The department said the PHP security team had scheduled security updates for release on October 21, and advised institutions to confirm affected versions and available fixes through official PHP security announcements.

Latest Stories

• Pope Leo will not need further cancer treatment — Vatican
• Experimental sound-wave therapy could help patients whose schizophrenia resists medication
• Kenya’s inflation set to rise further as food, fuel and transport costs squeeze households
• Kenyan CEOs grow more optimistic about economy as festive spending lifts business outlook

All ministries, departments and agencies have been directed to identify websites, web applications, servers and other systems running PHP, prioritising those accessible through the internet and platforms providing critical digital services.

Institutions must also establish whether third-party applications, hosting platforms and managed services use vulnerable PHP components.

Administrators have also been instructed to prepare to install the relevant security updates immediately after their official release. They must verify the affected versions and applicable fixes against official PHP guidance and vendor advisories before deployment.

The department emphasised that, “where an affected internet-facing system cannot be secured promptly, institutions should assess the need to restrict external access or temporarily take the system offline until effective mitigation has been implemented.”

Such decisions should be coordinated with the relevant service owners to manage operational and public-service implications.

The advisory also requires institutions to review web server, application, endpoint and network logs for unusual requests, unauthorised access, unexpected file changes, suspicious processes and other signs of possible compromise.

Government agencies have further been directed to strengthen web application firewall rules, access controls and other relevant security measures. However, the advisory cautioned that temporary protective measures should not replace the installation of official security updates.

Institutions must also engage hosting providers, software developers and other service providers to establish whether their systems are affected, confirm plans to address the vulnerabilities and obtain assurances that affected components have been secured.

Where a security breach is suspected or detected, agencies must activate their incident response procedures, preserve relevant logs and evidence, and promptly report the incident through established government cybersecurity reporting channels.

The ICT Authority said it will coordinate technical guidance and support to help government institutions identify potentially affected systems, address the vulnerabilities and monitor the implementation of the recommended measures.

All ICT directors and system administrators have been directed to prioritise action based on the level of exposure and the importance of the affected services, keep records of steps taken and escalate unresolved high-risk exposures through established government ICT and cybersecurity coordination channels.

Institutions unable to implement the required measures immediately must document the outstanding risks, the protective controls in place and the timelines for addressing the vulnerabilities.

“All Government institutions are required to treat this advisory as urgent and ensure that the necessary technical and administrative measures are undertaken to safeguard government websites, information systems and digital public services,” reads the advisory.