The government has issued an urgent cybersecurity alert to ministries, departments and agencies over two critical vulnerabilities in PHP, the programming language that powers a large share of the world's websites, including many Kenyan government and business platforms.

The advisory, issued by the State Department for ICT and the Digital Economy together with the ICT Authority, warns that the flaws "may pose a significant risk to the confidentiality, integrity and availability" of government systems and online public services, The Star reported.

What the flaws allow

Each of the two vulnerabilities has been rated 9.2 on the Common Vulnerability Scoring System, placing them in the critical category. They could allow remote code execution, meaning an attacker could run malicious code on an affected server without needing a password.

Security agencies abroad have warned that the bugs could give attackers a direct route into a server's file system or database, potentially allowing them to steal data, alter website content or disrupt services, Kenyans.co.ke reported.

The flaws were made public on Tuesday, 20 October, and PHP's maintainers released security updates on Wednesday, 21 October, urging users to install them immediately. Kenyans.co.ke reported that the bugs were identified with the help of artificial intelligence models, and that the research and preparation of fixes took about two months.

What institutions have been told to do

The advisory directs public institutions to identify all potentially affected systems, starting with internet-facing websites, web applications and servers running PHP. They are also required to check whether third-party applications, hosting platforms and managed services they use contain vulnerable components.

Agencies have been told to apply the official fixes as soon as they have verified the affected versions. Where a system cannot be secured quickly, they should consider restricting external access to it or taking it offline, while coordinating with service owners to limit disruption.

The ICT Authority has also asked institutions to review web server, application, endpoint and network logs for unusual requests, unauthorised access, unexpected file changes and suspicious processes. Tightening web application firewall rules and access controls can offer temporary protection, but the advisory stresses that such measures are not a substitute for installing the official updates.

Global response

The vulnerabilities have prompted precautionary action around the world. The Netherlands took some government websites offline, while Finland and France temporarily shut down some public-facing government sites, according to Kenyans.co.ke.

The United States National Security Agency advised organisations to "take the system offline until it can be fully mitigated" if they cannot update immediately, while the UK's National Cyber Security Centre gave similar guidance. WordPress urged its users to fix the underlying PHP issue rather than relying on a WordPress update alone, and Cloudflare said it had deployed default firewall protections before the flaws were disclosed.

What it means for Kenya

PHP runs roughly 70 per cent of websites globally, and thousands of Kenyan sites rely on it, including platforms linked to public services, education, telecommunications and business. Experts note, however, that the warning does not mean every PHP website is vulnerable, nor that any Kenyan agency or company has been breached.

Businesses and website owners outside government are also being encouraged to check with their developers and hosting providers to confirm that their PHP installations have been updated.

Photos: web address on a screen, Kenyans.co.ke file; server racks, Victor Grigas/Wikimedia Commons (CC BY-SA 3.0).