Kenya has issued a critical cybersecurity alert over two PHP vulnerabilities, each rated 9.2, that could allow attackers to remotely execute code on affected government websites and systems….reports Africa Daily News Desk
Kenya’s Ministry of Information, Communications and the Digital Economy has warned government institutions of critical cybersecurity vulnerabilities affecting PHP-based websites, web applications and digital services.
The advisory, dated 21 October 2026, was issued by the State Department for ICT and the Digital Economy in collaboration with the ICT Authority. It classifies the risk as critical and applies to all ministries, departments and agencies.
According to the advisory, the PHP security team had announced two critical vulnerabilities, each carrying a Common Vulnerability Scoring System (CVSS) rating of 9.2. Security updates were scheduled for release on 21 October, with institutions urged to verify affected versions and fixes through official PHP security announcements.
The vulnerabilities could expose affected systems to remote code execution, potentially allowing attackers to run malicious code on vulnerable servers. Given PHP’s widespread use in web-based systems, the flaws could pose risks to the confidentiality, integrity and availability of government information systems and online public services.
Government agencies urged to act urgently
The advisory directs government institutions to identify websites, web applications, servers and other systems running PHP, prioritising internet-facing platforms and critical digital services.
Institutions have also been asked to determine whether third-party applications, hosting platforms and managed services rely on vulnerable PHP components.
System administrators are expected to prepare to install the relevant security updates as soon as they are officially released. They must verify affected versions and fixes against official PHP guidance and vendor advisories before deploying the updates.
Where an internet-facing system cannot be secured promptly, institutions should assess whether external access needs to be restricted or the system temporarily taken offline until effective mitigation measures are implemented. Such decisions should be coordinated with the relevant service owners to minimise disruption to operations and public services.
The advisory also calls for a review of web server, application, endpoint and network logs to identify suspicious activity. This includes unusual requests, unauthorised access, unexpected file modifications, suspicious processes and other possible indicators of compromise.
Government agencies have been instructed to strengthen web application firewalls, access controls and other relevant security measures. The advisory emphasises that temporary protective measures should not replace the installation of official security updates.
Institutions are also expected to work with hosting providers, software developers and other service providers to assess exposure, agree on remediation arrangements and confirm that affected components have been secured.
If a security breach is suspected or detected, agencies should activate their incident response procedures, preserve relevant logs and evidence, and report the incident through established government cybersecurity reporting channels.
ICT Authority to coordinate response
The ICT Authority will coordinate technical guidance and support for government institutions as they identify potentially affected systems, implement fixes and monitor compliance.
ICT directors and system administrators have been instructed to prioritise remediation according to the level of exposure and the importance of the affected services. They must maintain records of actions taken and escalate unresolved high-risk vulnerabilities through established government ICT and cybersecurity coordination mechanisms.
Institutions unable to implement the required measures immediately must document outstanding risks, the compensating controls in place and planned remediation timelines.
The advisory requires all government institutions to treat the warning as urgent and take the necessary technical and administrative steps to protect government websites, information systems and digital public services.
Further technical guidance is expected as additional information becomes available from the PHP security team and recognised cybersecurity authorities.
