Kenya tells state agencies to patch PHP websites over two critical flaws

Kenya's State Department for ICT and the Digital Economy and the ICT Authority have told ministries, departments and agencies to identify the websites, web applications and servers they run on PHP and install the PHP security fixes released on 21 October 2026. Institutions that cannot secure exposed systems promptly should consider restricting outside access or temporarily taking them offline.

The advisory, dated 21 October, was issued by the Ministry of Information, Communications and the Digital Economy through the State Department and the ICT Authority, the Kenyan tech site TechTrendsKE reported on 22 October; The Star reported the advisory the same day. The advisory warns that, given how widely PHP is used, the two flaws "may pose a significant risk to the confidentiality, integrity and availability" of government information systems and online public services.

PHP is a widely used programming language that powers websites, web applications and digital public service platforms. A vulnerability is a weakness in software that an attacker can use; a patch, or security update, is the new version that closes it. "PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites," the security firm Huntress said, as quoted by the BBC.

The PHP project said PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that "can allow unauthenticated remote code execution": an attacker who has not logged in could make a server run code of their choosing. "All PHP users are strongly encouraged to update immediately," it said. Its advance notice of 20 October rated both flaws 9.2 under version 4.0 of the Common Vulnerability Scoring System (CVSS).

The first flaw, CVE-2026-109618, lies in the way PHP handles running out of memory, which can interrupt it while internal request data is only partly set up; cleanup may then treat that invalid data as valid. The second, CVE-2026-109619, lets internal data tied to one request survive after its memory has been freed, so a later request handled by the same worker may use it. The pair are known collectively as php2shell.

All PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The project rates the risk highest for mod_php, where it has a demonstrated exploit in which an unauthenticated request triggers the attack before any application code runs.

PHP 8.1 and older no longer receive updates from the PHP project. Because of the severity, its security team published minimal source backports for PHP 7.4, 8.0 and 8.1, and some distributions and long-term support vendors offer backported fixes. Configuration changes the project lists for those who cannot update at once reduce exposure to specific attack paths but "do not make an installation safe".

The Kenyan advisory tells agencies to put internet-facing websites, web applications and servers first, to check whether third-party applications, hosting platforms and managed services contain vulnerable components, and to confirm affected versions and fixes through official PHP security announcements and vendor advisories. Updating a website's themes, plugins or application code alone will not correct a flaw in the PHP runtime itself, and administrators must confirm that the running service has actually been updated.

Agencies must also review web server, application, endpoint and network logs for unusual requests, unauthorised access, unexpected file changes and suspicious processes. Stronger web application firewall rules and access controls are temporary protections and do not replace the official updates. ICT directors and system administrators must document their actions and escalate high-risk exposures; where a fix cannot be applied, they must record the residual risks, the compensating controls and the expected remediation timeline. Suspected incidents are to be reported through government cybersecurity channels, with evidence preserved. The ICT Authority will coordinate technical guidance and support and monitor implementation.

Abroad, some organisations took sites down. Finland temporarily shut the government's public web services, the website of the Tweede Kamer, the lower house of the Dutch parliament, became inaccessible, and the Wikimedia Foundation took down a number of systems as a precaution, the BBC reported in a story republished by The Star. The US National Security Agency advised organisations to take their systems offline if they could not update, and Japan's Prime Minister Sanae Takaichi urged people to check whether their public websites ran on PHP.

The flaws were found by researchers at the cyber-security firms Calif and Wiz and had gone undetected for more than a decade. Wiz estimated that "roughly 70%" of the internet is affected, a figure the BBC said it was unable to verify. The US Cybersecurity and Infrastructure Security Agency said it had not observed exploitation of these vulnerabilities at the time of its statement, while warning that unpatched systems remained at risk.

In July 2026 the Kenyan government admitted that President William Ruto's official website, president.go.ke, had been hacked, The Standard reported on 18 July. Some users who tried to open the site said its homepage had been defaced with messages targeting the government. The government said then that there was no evidence of unauthorised access to sensitive data.

PHP 8.2, one of the four patched branches, reaches end of life on 31 December 2026 and will receive no security fixes after that date.