Cyber Security Authority, NITA Issue Alert on Critical PHP Vulnerabilities
The Cyber Security Authority (CSA) and the National Information Technology Agency (NITA) have issued a public alert to government institutions, businesses, website owners, hosting providers and operators of Critical Information Infrastructure over two critical vulnerabilities in Hypertext Preprocessor (PHP).
“The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619 and commonly referred to as “PHP2Shell”, could allow attackers to take control of affected servers without a username or password,” they stated.
According to the two institutions on Thursday, successful exploitation could expose sensitive information, disrupt services and enable further attacks against an organisation’s network.
CSA and NITA indicated that security updates have been released by the PHP Project in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, and urged organisations to immediately install the appropriate fixed release, a later supported release or a vendor package confirmed to contain the fixes.
They also directed organisations to identify affected systems, apply security updates, take unpatched services offline where necessary, check for signs of compromise and obtain confirmation from service providers that affected systems have been patched.
The two institutions further called on heads of government institutions to ensure that their ICT teams and service providers act urgently, noting that NITA will coordinate technical support for government digital assets and services while the CSA will coordinate cybersecurity incident reporting and response.
CSA and NITA also directed all government institutions to act within seven days and report remedial actions taken.
They advised the public to be cautious of messages requesting downloads of purported PHP security updates, disclosure of passwords or payment details, and encouraged website owners to obtain updates only from official software sources or verified service providers.
Margaret Adjeley Sowah, ISD
