Kenya’s government agencies have been placed on high alert after critical security flaws were found in PHP, a programming language used by websites worldwide.
The Ministry of ICT and Digital Economy has ordered urgent checks. Agencies have been told to identify vulnerable systems and apply security updates.
The warning follows the disclosure of flaws known as PHP2Shell. Researchers say they could allow hackers to run malicious code on affected servers without logging in. Sensitive information could also be exposed.
Government Agencies Told to Act
In a statement issued on Wednesday night, the Ministry called for stronger protection of government websites and online services.
Administrators were urged to confirm which PHP versions were affected. Official security guidance was also to be checked before updates were installed.
“Temporary protective measures should not be treated as a substitute for applying the official security updates,” the Ministry cautioned.
Web application firewalls and access controls are also to be reviewed. Systems facing the greatest risks are to be prioritised.
The ICT Authority will coordinate technical support. Vulnerable systems are to be identified, while progress is to be monitored. Unresolved high-risk issues must be escalated.
What Is PHP2Shell?
PHP is a widely used language for building websites and web applications. It supports major platforms, including WordPress, Drupal and Joomla.
The newly disclosed flaws affect the PHP engine itself. They are not limited to one website platform.
Security researchers have warned that successful attacks could allow remote code execution. This means malicious commands could be run on an affected server without the attacker having an account.
The flaws have been assigned the identifiers CVE-2026-109618 and CVE-2026-109619. Both received severity scores of 9.2 out of 10 under the CVSS 4.0 system.
Security Updates Released
The PHP security team released fixes on October 21, following the discovery of the flaws by researchers.
Patched versions include PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Organisations have been urged to upgrade to the appropriate fixed version without delay.
Older versions that no longer receive official support may need a broader upgrade plan. Organisations have been advised to check whether their software providers offer supported security fixes.
Security measures such as firewalls may reduce exposure. However, they should not be treated as a replacement for patching.
Artificial Intelligence Helped Find the Flaws
The vulnerabilities were uncovered by security researchers using advanced artificial intelligence models to examine PHP’s underlying code.
According to Wiz Research, the first flaw was identified in August. The findings were reported to the PHP security team, and fixes were prepared before public disclosure.
The case has drawn attention to AI’s growing role in cybersecurity. The technology can help defenders find weaknesses that might otherwise remain hidden. The same capabilities also raise concerns about how quickly vulnerabilities could be discovered and exploited.
For Kenya, the immediate priority is to establish which government systems are exposed and ensure the necessary updates are applied.
The Ministry has urged all government institutions to treat the warning as urgent. No claim has been made in the advisory that every government website has been compromised.
