The Minsitry of ICT and the Digital Economy has directed all ministries, departments, and agencies to check their websites and online services for two critical vulnerabilities in PHP, a programming language used across much of the web.
They have also been told to prepare to apply security fixes as soon as they become available.
The two vulnerabilities each score 9.2 out of 10 for severity and could let an attacker run their code on an affected server. The flaws have existed in every PHP version since PHP 5 arrived in 2004, and an attacker does not need to log in to exploit them.
For the government, the exposure reaches beyond websites to the confidentiality, integrity, and availability of information systems and the online services citizens rely on.
Fixing it is also less straightforward than pressing update. Many state systems run on third-party software and managed hosting, and platforms such as WordPress cannot repair the flaw on their own, leaving the work to whoever controls the server.
That explains why the advisory pushes agencies to seek assurance from their hosts and developers instead of assuming the problem has been handled.
Governments elsewhere have responded the same way, with agencies in Britain, the EU, and Australia issuing similar warnings, and some Finnish and French public sites going offline before fixes arrived.
The advisory asks agencies to:
- Identify all websites, applications, and servers running PHP, starting with public-facing ones.
- Check whether third-party applications, hosting platforms, and managed services use vulnerable PHP.
- Apply official security updates as soon as they are released.
- Restrict external access or take systems offline if they cannot be secured promptly.
- Review logs for signs of compromise.
- Strengthen firewalls and access controls in the meantime.
- Activate incident response and report suspected breaches through government channels.
Interim protections are not a way around patching, with the advisory stating that temporary measures “should not be treated as a substitute for applying the official security updates.”
Taking a system offline is framed as a judgment call to be made with service owners so that disruption to the public is weighed against the risk of leaving it exposed.
READ: Kenya Records 29% Rise in Cyber Threats to 11.12 Billion
The ICT Authority will coordinate technical guidance and track how institutions are progressing, while ICT directors and system administrators are expected to fix the most exposed and most critical services first, keep records of their actions, and escalate high-risk problems they cannot resolve.
Agencies that cannot act immediately must document the outstanding risks, the temporary controls in place, and a timeline for full remediation, which leaves a clear record of who knew what and when they acted.
The advisory sets no deadline for compliance and stops short of confirming whether any government system has been compromised while leaving out the list of affected versions and pointing institutions to official PHP announcements instead.
Only PHP 8.2 and newer still receive official fixes, which leaves any agency running an older version with an upgrade to plan. Further guidance is promised as more details emerge from the PHP security team and other cybersecurity authorities.
