The Cyber Security Authority (CSA) and the National Information Technology Agency (NITA) have issued an urgent public cybersecurity alert, warning government institutions, businesses, website owners, hosting providers and operators of critical information infrastructure to take immediate action against two critical vulnerabilities affecting PHP, a widely used programming language that powers websites and online services.
According to the joint alert, the vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, and collectively referred to as “PHP2Shell,” could enable attackers to take control of affected servers without requiring a username or password.
The agencies cautioned that successful exploitation could expose sensitive information, disrupt services and provide attackers with a foothold to launch further attacks on organisational networks.
To mitigate the threat, the PHP Project has released security fixes in versions PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Organisations have been advised to immediately upgrade to the appropriate fixed release or a vendor-supported version containing the patches.
The CSA and NITA stressed that updating website themes or plugins alone would not address the vulnerabilities, as the flaws exist within the underlying PHP software itself.
As part of recommended mitigation measures, organisations have been directed to identify all systems running PHP, prioritise internet-facing platforms and essential public services, apply security updates without delay and verify that patched software is operational.
Where immediate updates are not possible, affected services should be temporarily taken offline until they can be secured. Institutions have also been advised to review system logs, investigate unusual activities, isolate compromised systems and preserve evidence for further analysis.
The alert further calls on organisations to obtain written confirmation from hosting providers, developers and system administrators that all affected systems have been identified and patched.
For government institutions, the agencies have directed heads of organisations to ensure that ICT teams and service providers act urgently. NITA will coordinate technical support for government digital assets and services, while the CSA will oversee cybersecurity incident reporting and response.
Institutions have also been instructed to maintain updated inventories of digital assets and designate responsible officers to support remediation efforts in line with NITA’s Government Digital Assurance Programme (GovDAP).
In a directive to all government agencies, the CSA and NITA mandated that remedial actions be completed and reported within seven days.
The agencies also warned members of the public to be cautious of messages requesting downloads of so-called “PHP security updates,” disclosure of passwords or payment information, advising website operators to obtain updates only through official software sources or verified service providers.
The joint alert, issued in Accra on October 22, 2026, urged all affected organisations to treat the threat as a matter of urgency and act immediately to prevent potential compromise of critical systems and services.