The National Computer and Cybercrimes Coordination Committee (NC4) advises all organisations and individuals in Kenya operating PHP-based websites, portals and applications to apply security updates addressing PHP2Shell — CVE-2026-109618 and CVE-2026-109619.
These critical vulnerabilities could allow unauthenticated attackers to execute malicious code, compromise data and disrupt services. Systems operated internally or managed by hosting providers and other vendors require review.
Administrators should update affected installations to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, as appropriate, or a later patched release. Older installations should migrate to a supported version or obtain vendor confirmation of backported fixes.
Identify affected systems, confirm patch completion with service providers, restart relevant services and review for signs of compromise. Where immediate updating is not possible, consider temporarily restricting public access.
Updating website plugins or a content management system alone does not fix the underlying PHP vulnerabilities.