- The State Department for ICT and the Digital Economy flagged two critical PHP vulnerabilities, each rated CVSS 9.2, affecting government websites and web applications
- The advisory, issued on October 21, 2026, warned the flaws could expose government systems to remote code execution by malicious actors
- All government ministries, departments and agencies received urgent orders to identify affected systems and apply security patches immediately upon release
TUKO.co.ke journalist Japhet Ruto has over eight years of experience in financial, business, and technology reporting, offering insights into Kenyan and global economic trends.
Kenya's State Department for ICT and the Digital Economy has issued a critical cybersecurity advisory to all government institutions, warning that widely used web programming technology contains severe vulnerabilities that could expose official digital systems to attack.
Source: Twitter
The advisory, released on October 21, 2026, in collaboration with the ICT Authority, identified two security flaws in PHP, a server-side programming language that underpins a large number of government websites, web applications and digital service platforms across Kenya's public sector.
Which vulnerabilities did the ICT ministry identify?
Both vulnerabilities carry a Common Vulnerability Scoring System (CVSS) rating of 9.2, placing them in the critical severity band.
Search option is now available at TUKO! Feel free to search the content on topics/people you enjoy reading about in the top right corner ;)
The PHP security team had scheduled the release of corrective updates for October 21, 2026. According to the advisory, the flaws create conditions for remote code execution, meaning an attacker could potentially run malicious instructions on a compromised server from a remote location.
"Given the widespread use of PHP in web-based systems, these vulnerabilities may pose a significant risk to the confidentiality, integrity and availability of government information systems and online public services," the ministry stated.
What government agencies must do
The advisory directed all ICT directors and system administrators to immediately identify any websites, servers or applications running PHP, with priority given to internet-facing systems and services accessible to the public.
Institutions were also instructed to verify whether third-party hosting providers or managed service platforms rely on vulnerable PHP components.
Where a system cannot be secured quickly, the ministry advised restricting external access or taking the affected platform offline temporarily until a fix is in place. Administrators were further directed to review server logs for signs of suspicious activity, including unauthorised access attempts and unexpected file changes.
On web application protection, the advisory cautioned that temporary firewall measures should not replace the official security updates and instructed agencies to engage software developers and hosting providers to confirm that affected components are remediated.
Any institution that suspects a compromise was directed to activate its incident response procedures, preserve logs and evidence, and report the incident through established government cybersecurity channels.
What happened to Ruto's website?
The ICT ministry's warning came months after the cyberattack on President William Ruto’s official website.
The attackers left a ransom demand and threatened to leak government data.
Authorities said there was no evidence that sensitive information was accessed or lost.
Source: TUKO.co.ke