Kenya’s government has ordered public institutions to urgently patch two critical vulnerabilities in the PHP programming language or take affected systems offline.
Security experts warn that attackers began attempting to exploit the flaws within hours of their disclosure.
The advisory, issued by the Ministry of Information, Communications and the digital Economy through the State Department for ICT and the ICT Authority, covers CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell.
Both vulnerabilities carry a CVSS score of 9.2 out of 10 and can enable unauthenticated remote code execution. The PHP development team released security fixes on 21 October 2026 in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
“All Government institutions are required to treat this advisory as urgent,” says the ministry.
The ICT Authority will coordinate the government-wide response, while the ministry plans to overhaul government websites and applications.
“The ICT Authority shall coordinate technical guidance and support to Government institutions,” the ministry says.
The vulnerabilities stem from memory-handling flaws in the PHP runtime. Specially crafted HTTP requests can trigger memory corruption, potentially allowing attackers to execute code remotely and compromise affected servers.
PHP is widely used to power websites and web applications.
According to the PHP development team, all PHP installations serving web requests are potentially affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
Apache installations using mod_php face particular risk because exploitation can occur before application code runs.
“If you run PHP, it is imperative that you update now,” the PHP development team says.
Richard Ford, group CTO at cybersecurity firm Integrity360, says the flaws put a significant number of websites and applications at risk.
“Apache installations using mod_php are particularly exposed, with a working proof-of-concept exploit already demonstrated,” he says.
The speed of reported exploitation has raised concerns among security leaders. Matthew Prince, co-founder and CEO of Cloudflare, says the company recorded thousands of exploitation attempts across its network in the 10 hours before the flaws were publicly announced.
“That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now,” Prince says.
These figures reflect Cloudflare’s reported observations and should not be interpreted as independently verified global attack totals.
There is no indication in the available information that Kenyan government systems have been targeted.
Security firms, including Wiz, used AI models from OpenAI and Google to identify them in August. Ford says one of the underlying bugs reportedly dates back to 2004.
“This shows how new technology can uncover weaknesses that have remained hidden for decades,” he says.
According to data and analytics firm GlobalData, PHP2Shell has dominated cybersecurity discussions on X since 21 October, with some commentators viewing the discovery as a turning point in vulnerability research and exploitation.
“Influencers largely see PHP2Shell as proof that cybersecurity is entering a phase where speed matters as much as severity,” says Smitarani Tripathy, social media analyst at GlobalData.
“Influencers expect PHP2Shell to be a template rather than an exception, with more critical vulnerabilities on the way, since flaws that look impractical to exploit today may become easy targets as models advance.”
Tripathy says this could push enterprises towards automated patching and virtual patching through web application firewalls.
“Organisations relying on slow patch cycles or unsupported PHP versions face rising risk,” she says.
George Kurtz, CEO of cybersecurity company CrowdStrike, has expressed a similar concern: “What seems impractical to exploit today could easily be exploitable tomorrow as models advance.”
The Kenyan ministry has directed agencies to identify every system running PHP, including those hosted or managed by third parties, and prioritise remediation according to exposure and service criticality.
It warns that updating themes, plugins or application code alone will not resolve the vulnerabilities because they affect the PHP runtime itself.
“Temporary protective measures should not be treated as a substitute for applying the official security updates,” the ministry says.
Ford agrees that patching is the only complete fix. He advises organisations unable to patch immediately to consider taking internet-facing services offline and checking for signs of compromise, including unexpected shell activity and suspicious outbound web requests.
He warns that, as with the 2021 Log4Shell vulnerability, organisations may struggle to identify vulnerable software embedded in third-party applications.
“Businesses need to work closely with their suppliers to establish their exposure and confirm what action is being taken. The risk extends beyond systems they manage directly,” he says.
Share
