Your website could be at risk: CSA, NITA issue urgent cybersecurity alert

The Cyber Security Authority (CSA) and the National Information Technology Agency (NITA) have directed government institutions to address two critical vulnerabilities in PHP, warning that attackers could exploit the flaws to take control of affected servers without requiring login credentials.

The two vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619 and collectively referred to as “PHP2Shell”, affect PHP, a programming language widely used to power websites and online services.

In a joint security alert, the agencies directed all government institutions to take remedial action within seven days and report the measures taken to both authorities.

The vulnerabilities could expose sensitive information, disrupt online services and allow attackers to launch further attacks against affected organisations’ networks.

The CSA and NITA have urged government institutions, businesses, website owners, hosting providers and operators of Critical Information Infrastructure to treat the alert as urgent and install the relevant security updates.

Affected organisations have been advised to upgrade to the appropriate fixed version, a later supported release or a vendor package confirmed to contain the fixes.

The agencies cautioned that updating website themes or plugins alone would not resolve the vulnerabilities in the underlying PHP software.

Organisations have also been directed to identify all affected websites, applications and servers, prioritising systems accessible through the internet and essential public services. Where immediate patching is not possible, affected services should be temporarily taken offline until they can be secured.

The alert further advises system administrators to inspect server logs, unusual processes, unexpected administrator accounts and unauthorised changes to website files to determine whether their systems have already been compromised.

Any suspected compromised system should be isolated, with relevant evidence preserved for investigation.

For government institutions, NITA will coordinate technical support for digital assets and services, while the CSA will oversee cybersecurity incident reporting and response.

Heads of institutions have been asked to ensure that their information and communications technology teams and external service providers act promptly, maintain updated inventories of digital assets and designate officers to coordinate remediation under the Government Digital Assurance Programme (GovDAP).

The agencies have also cautioned the public against messages requesting downloads of purported PHP security updates, passwords or payment details, advising website owners to obtain updates only from official software sources or verified service providers.

Organisations and individuals who suspect a cybersecurity incident can contact the CSA by calling or sending an SMS to 292, or by emailing [email protected].

Government institutions seeking assistance with digital services coordination and GovDAP can contact NITA at [email protected] or 055 249 9661.