The Cyber Security Authority (CSA) and the National Information Technology Agency (NITA) have issued a public cybersecurity alert warning government institutions, businesses, website owners, hosting providers and operators of Critical Information Infrastructure about two critical vulnerabilities affecting PHP, a widely used programming language for websites and online services.
The agencies said the vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619 and collectively known as “PHP2Shell,” could allow attackers to take control of affected servers without requiring a username or password.
According to the alert, successful exploitation of the vulnerabilities could expose sensitive information, disrupt digital services and create pathways for further cyberattacks against organisational networks.
CSA and NITA indicated that security updates have already been released by the PHP Project to address the flaws. The fixes are available in PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12, and organisations have been urged to install the appropriate updates immediately.
The agencies cautioned that updating website themes or plugins alone would not resolve the vulnerabilities, stressing that organisations must update the underlying PHP software itself.
As part of immediate mitigation measures, affected organisations have been advised to identify all websites, web applications and servers running PHP, including systems managed by external service providers. Priority, they said, should be given to internet-facing systems and essential public services.
The alert further urged organisations to apply security patches without delay, restart affected services where necessary and verify that updated software is operational. Where immediate updates are not possible, organisations have been advised to temporarily take vulnerable services offline until they can be properly secured.
CSA and NITA also called on organisations to review system logs, investigate unusual processes, monitor for unauthorised administrator accounts and check for suspicious changes to website files to determine whether systems may already have been compromised.
The agencies recommended that organisations obtain written confirmation from hosting providers, developers and system administrators that affected systems have been identified and patched.
For government institutions, the advisory places responsibility on heads of agencies to ensure that ICT teams and service providers act urgently. NITA has been tasked with coordinating technical support for government digital assets and services, while CSA will oversee cybersecurity incident reporting and response.
Institutions have also been directed to maintain updated inventories of their digital assets and designate responsible officers to support remediation efforts under NITA’s Government Digital Assurance Programme (GovDAP).
In a directive to all government agencies, CSA and NITA instructed institutions to complete the necessary remedial actions and submit reports on measures taken within seven days.
The public has meanwhile been advised to be cautious of unsolicited messages requesting downloads of so-called PHP security updates, disclosure of passwords or payment details, warning that cybercriminals may exploit the situation through fraudulent schemes.
For cybersecurity incidents or suspected system compromise, the agencies urged organisations and individuals to contact CSA through its emergency reporting channels, while GovDAP-related enquiries should be directed to NITA.
The alert, jointly issued by CSA and NITA on October 22, underscores the growing importance of proactive cybersecurity measures as organisations increasingly rely on digital platforms to deliver services and manage sensitive information.