CSA and NITA order government institutions to fix critical PHP vulnerabilities within seven days

The Cyber Security Authority (CSA) and the National Information Technology Agency (NITA) have directed government institutions to address two critical vulnerabilities in PHP within seven days, warning that the flaws could allow attackers to take control of affected servers without a username or password.

In a joint cybersecurity alert on Thursday, October 22, the agencies urged government institutions, businesses, website owners, hosting providers and operators of Critical Information Infrastructure to treat the threat as urgent and implement available security fixes.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619 and referred to as “PHP2Shell”, affect PHP, a programming language widely used to run websites and online services.

Successful exploitation could expose sensitive information, disrupt digital services and allow attackers to launch further attacks against an organisation’s network.

Security fixes available

The agencies said the PHP Project had released fixes in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

Affected organisations have been advised to install the appropriate patched release, upgrade to a later supported version or apply a vendor package confirmed to contain the fixes.

They cautioned that updating website themes or plugins alone would not resolve vulnerabilities in the underlying PHP software.

Seven-day deadline for government institutions

Under the directive, all government institutions are required to take action within seven days and report the remedial measures taken to the CSA and NITA.

Heads of institutions have been instructed to ensure that their information and communications technology (ICT) teams and service providers act urgently to identify and secure affected systems.

NITA will coordinate technical support for government digital assets and services, while the CSA will oversee cybersecurity incident reporting and response.

Institutions are also expected to maintain an up-to-date inventory of their digital assets and nominate responsible officers to support remediation and coordination under NITA’s Government Digital Assurance Programme (GovDAP).

Five steps to protect digital systems

The agencies have outlined five key measures for affected organisations.

First, they should identify all websites, web applications and servers running PHP, including those managed by external service providers, prioritising internet-facing systems and essential public services.

Second, they must apply the relevant security updates, follow vendor instructions, restart affected services where necessary and verify that the patches are working.

Third, systems that cannot be updated immediately should be temporarily taken offline until they can be secured. Temporary protective measures should not replace permanent patching.

Fourth, organisations should investigate possible compromises by reviewing system logs, unusual processes, unexpected administrator accounts and unauthorised changes to website files. Suspected compromised systems should be isolated and evidence preserved.

Finally, website owners should obtain written confirmation from hosting providers, developers and system administrators that affected systems have been identified and patched.

Public warned against fraudulent security updates

The CSA and NITA have also cautioned the public against suspicious messages requesting downloads of purported “PHP security updates”, passwords or payment details.

Website owners have been advised to obtain security updates only through official software sources or verified service providers.

Where to report incidents

Organisations and individuals who suspect a cybersecurity incident or system compromise can contact the CSA through the following channels:

• Call or SMS:

  292

• Email:

  [email protected]

For government digital services coordination and GovDAP enquiries, NITA can be contacted on:

• Email:

  [email protected]

• Telephone:

  055 249 9661

The agencies have urged all affected organisations to act immediately to protect sensitive information, maintain the availability of essential digital services and prevent further compromise of their systems.