Kenya’s government has issued a critical cybersecurity advisory directing ministries, departments and agencies to secure websites and web applications running PHP after the discovery of two vulnerabilities that could allow attackers to execute malicious code on affected servers.
The advisory, dated 21 October 2026, was issued by the Ministry of Information, Communications and the Digital Economy through the State Department for ICT and the Digital Economy and the ICT Authority. It classifies both vulnerabilities as critical, with each carrying a Common Vulnerability Scoring System (CVSS) score of 9.2, and directs agencies to prioritise systems accessible from the internet.
The warning comes as PHP developers release security updates and cybersecurity firms report attempts to exploit the flaws. Identified as CVE-2026-109618 and CVE-2026-109619, the vulnerabilities are collectively referred to as php2shell and affect the PHP runtime used to process web requests.
Kenya directs government agencies to secure PHP systems
The ICT Authority has instructed government agencies to identify websites, applications and servers running PHP, including systems hosted or managed by third-party providers. Agencies are expected to establish which installations are affected, verify the appropriate fixes against official PHP and vendor guidance, and apply the updates as a priority.
Where an affected system cannot be secured immediately, agencies have been directed to restrict external access or take it offline. The advisory also calls for reviews of web application, endpoint and network logs to identify suspicious requests, unauthorised access, unexpected files and unusual processes that could indicate malicious activity.
The instructions extend to web application firewalls and other access controls, which can help limit exposure while remediation is under way. However, these controls are supplementary measures rather than replacements for installing the relevant security updates. Agencies are also expected to work with developers and service providers, preserve evidence where an incident is suspected, and report through government cybersecurity channels.
The ICT Authority is responsible for coordinating technical guidance and support while monitoring implementation. ICT directors and system administrators have been instructed to prioritise remediation, document their actions and escalate high-risk exposures. Where immediate patching is not possible, agencies must record residual risks, compensating controls and the expected remediation timeline.
What the PHP vulnerabilities could allow attackers to do
PHP is a server-side programming language used to generate dynamic websites and power web applications. When a browser sends a request, a PHP-enabled server processes the relevant code and returns a response. Because this processing takes place on the server, flaws in the runtime can expose systems beyond the individual website or application using it.
The two php2shell vulnerabilities involve memory-handling problems that can affect how PHP processes requests. One involves an out-of-memory condition that can interrupt the initialisation of internal request data, while the other concerns stale internal references after request memory has been released. Under vulnerable configurations, these conditions can create opportunities for memory corruption and potentially remote code execution.
Remote code execution is particularly serious because it can allow an attacker to run commands or code on a server through a remote connection. Depending on the server’s permissions and configuration, successful exploitation could expose application data, compromise stored credentials, disrupt services or provide a foothold for further activity within an organisation’s infrastructure.
The vulnerabilities affect web servers running PHP 5.4 or later, according to Cloudflare, and can be triggered through specially crafted HTTP traffic. The PHP project has published fixes for supported release branches, including PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Administrators need to use the appropriate fixed release for their branch and confirm that the running service has actually been updated.
Updating a website’s themes, plugins or application code alone will not correct a vulnerability in the PHP runtime itself. Organisations must ensure that the underlying PHP installation and relevant server processes are running a fixed version.
Cloudflare reports exploit attempts as security teams respond
Cloudflare said it developed web application firewall protections for php2shell before public disclosure and deployed them to customers using its WAF protections on 21 October. The company also reported observing attack traffic targeting its customers, including payloads modified in attempts to evade detection. This provides evidence of exploitation attempts within Cloudflare’s observed traffic, although it does not establish that those attempts succeeded or that Kenyan government systems were targeted.
A web application firewall inspects HTTP traffic and can block requests that match known malicious patterns. Such protection can reduce exposure while organisations assess and update vulnerable systems, but it cannot provide the same assurance as correcting the underlying software flaw. Cloudflare has recommended that organisations apply the PHP updates while maintaining appropriate firewall protections.
The US National Security Agency also urged organisations running vulnerable PHP systems to update immediately or take them offline if they could not be secured. The US Cybersecurity and Infrastructure Security Agency said it had not observed exploitation of these specific vulnerabilities at the time of its statement, while warning that unpatched systems remained at risk. The assessments reflect different reporting scopes and observation points, and both underscore the need for rapid remediation.
The disclosure has also raised questions about vulnerability handling within the PHP project. The PHP Foundation acknowledged an early indication of one of the flaws in 2024, when researchers had not yet established a concrete exploitation method. The foundation described the delay in addressing the issue as a structural failure, highlighting the challenge of prioritising security concerns before researchers establish a practical attack path.
Why patching and incident readiness matter
The Kenyan advisory places responsibility on government agencies to establish which systems they operate, act on vendor fixes and check for signs of suspicious activity. That work can be complicated by legacy applications, outsourced hosting and systems maintained by different contractors, particularly where agencies have limited visibility into the software versions running beneath their public-facing services.
TechTrendsKE’s earlier reporting on Kenya’s cybersecurity landscape has highlighted the distinction between detected cyber threats and confirmed breaches, as well as the operational demands of incident response. The PHP warning brings those concerns into a specific government task: agencies must identify vulnerable installations, coordinate with the people responsible for maintaining them and verify that remediation has been completed.
The broader security picture also includes fresh updates from the Node.js project, which issued releases addressing vulnerabilities involving TLS hostname validation, DNS handling, Brotli decoding and other components on 21 October. Separately, security researchers reported a compromise involving LiteLLM packages and container images distributed through public repositories, with malicious code designed to steal credentials and enable remote access. These are distinct incidents, but together they illustrate how weaknesses in runtimes, dependencies and software distribution can expose organisations through different parts of their technology stack.
For Kenya’s public sector, the immediate priority is to follow the ICT Authority’s instructions: locate affected PHP installations, deploy the correct fixes, restrict exposure where remediation cannot be completed promptly, and investigate suspicious activity. Consistent execution across agencies will be essential to reducing the risk that a flaw in widely used web infrastructure becomes an entry point into government systems.
Real ESG impact doesn’t happen in panels alone, it happens in the rooms where financiers, operators, and policymakers actually align. Our GreenShift Forum 2026 cuts the noise, bringing together the people rewiring Africa’s sustainability and energy frameworks for one focused day in Nairobi. Secure your seat.
Go to TECHTRENDSKE.co.ke for more tech and business news from the African continent and across the world.
Follow us on WhatsApp, Telegram, Twitter, and Facebook, or subscribe to our weekly newsletter to ensure you don’t miss out on any future updates. Send tips to editorial@techtrendsmedia.co.ke
