State Department for ICT and the Digital Economy PS John Tanui/HANDOUT

The government has issued an urgent cybersecurity alert to public institutions over two critical vulnerabilities affecting PHP, a widely used programming language that powers websites, web applications and digital public service platforms.

In an advisory issued by the State Department for ICT and the Digital Economy in collaboration with the ICT Authority, government agencies were directed to identify potentially affected systems and prepare to install security updates released by the PHP security team.

The two vulnerabilities have each been rated 9.2 on the Common Vulnerability Scoring System (CVSS), indicating a critical security risk.

According to the advisory, the flaws could expose affected systems to remote code execution, potentially allowing attackers to execute malicious code on vulnerable servers.

“Given the widespread use of PHP in web-based systems, these vulnerabilities may pose a significant risk to the confidentiality, integrity and availability of Government information systems and online public services,” the advisory stated.

The security updates were scheduled for release on October 21, 2026, with administrators urged to confirm affected versions and the appropriate fixes through official PHP security announcements and vendor advisories.

The government directed institutions to prioritise internet-facing websites, web applications, servers and other systems running PHP, while also assessing whether third-party applications, hosting platforms and managed services contained vulnerable components.

Administrators were instructed to prepare to apply the relevant security updates immediately upon their official release, after verifying the applicable fixes and affected software versions.

The advisory further warned that institutions unable to secure exposed systems promptly should consider restricting external access or temporarily taking the affected services offline until effective mitigation measures are implemented.

Such decisions, it said, should be coordinated with service owners to minimise disruptions to government operations and public services.

Institutions were also directed to review web server, application, endpoint and network logs for unusual requests, unauthorised access, unexpected file modifications and suspicious processes that could indicate a security breach.

The government recommended strengthening web application firewall rules, access controls and other security measures, while cautioning that temporary protections should not replace the installation of official security updates.