---
title: "Kenya Issues Critical Advisory for PHP Website Flaws"
description: "Kenya’s government told ministries, departments and agencies to secure PHP websites after two critical flaws could allow attackers to run malicious code."
canonical_url: "https://liners.com/news/kenya-php-vulnerabilities-advisory-php2shell"
markdown_url: "https://liners.com/news/kenya-php-vulnerabilities-advisory-php2shell.md"
type: "article"
language: "en"
published_at: "2026-10-22T04:00:48.872Z"
updated_at: "2026-10-22T04:00:48.900Z"
---

# Kenya Issues Critical Advisory for PHP Website Flaws

Kenya’s government told ministries, departments and agencies to secure PHP websites after two critical flaws could allow attackers to run malicious code.

## Breadcrumbs

- [News](/news)
- [Kenya Issues Critical Advisory for PHP Website Flaws](/news/kenya-php-vulnerabilities-advisory-php2shell)

## Content

## In Short
Kenya’s government has issued a critical cybersecurity advisory for ministries, departments and agencies running websites and web applications on PHP.

The advisory warns of two vulnerabilities that could let attackers execute malicious code on affected servers.

It was issued through the Ministry of Information, Communications and the Digital Economy, the State Department for ICT and the Digital Economy, and the ICT Authority.

## What Happened: How Kenya Is Responding To php2shell
The advisory, dated 21 October 2026, classifies both vulnerabilities as critical, each with a Common Vulnerability Scoring System (CVSS) score of 9.2. CVSS is a standard way to rate how severe a security flaw is.

The two flaws are identified as CVE-2026-109618 and CVE-2026-109619. They are collectively referred to as php2shell and affect the PHP runtime, the part of PHP that processes web requests.

The ICT Authority instructed agencies to identify websites, applications and servers running PHP, including systems hosted or managed by third-party providers. Agencies are expected to confirm whether their installations are affected, verify fixes against official PHP and vendor guidance, and apply updates as a priority.

The advisory also directs agencies to prioritise systems accessible from the internet.

Where an affected system cannot be secured immediately, agencies have been told to restrict external access or take it offline.

The advisory calls for reviews of web application, endpoint and network logs to spot suspicious requests, unauthorised access, unexpected files and unusual processes.

It also mentions web application firewalls and other access controls as supplementary measures, not replacements for installing the security updates. Agencies are expected to work with developers and service providers, preserve evidence where an incident is suspected, and report through government cybersecurity channels.

## Why It Matters
PHP is widely used to run websites and web applications, including government portals. When critical vulnerabilities affect the PHP runtime, attackers may be able to compromise servers by sending crafted web requests.

The advisory notes that the warning comes as PHP developers release security updates and as cybersecurity firms report attempts to exploit the flaws. That combination raises the stakes for agencies with internet-facing systems.

For vendors and service providers supporting government systems, the directive also signals a need to confirm PHP versions in use, coordinate patching, and help customers review logs for signs of compromise.

## Sources and products

- [Tech Trends KE](https://techtrendske.co.ke/2026/10/22/kenya-php-vulnerabilities-advisory)

## Related pages

- [Policy & Regulation](/news)

## Access and citation

- [Canonical HTML page](https://liners.com/news/kenya-php-vulnerabilities-advisory-php2shell)
- [Markdown route index](/sitemap.md)
- [Agent access guide](/llms.txt)