The Government has ordered all public institutions to urgently secure their websites and online systems after two critical security flaws were discovered in PHP, the programming language that powers an estimated 70 per cent of the world’s websites. The flaws have already forced several European governments to take their websites offline.
In an advisory issued on the night of Wednesday, October 21, 2026, the State Department for ICT and Digital Economy and the ICT Authority directed ministries, departments and agencies to identify vulnerable systems and install the official security updates without delay.
“All Government institutions are required to treat this advisory as urgent and ensure that the necessary technical and administrative measures are undertaken to safeguard Government websites,” the ministry said.
No Kenyan government or business websites have so far been reported hacked or taken offline. Experts note that the warning does not mean every PHP-based site is vulnerable or that any Kenyan institution has been compromised.
However, the flaws, dubbed “PHP2SHELL” and each assigned a severity rating of 9.2 out of 10, could allow attackers to gain unauthorised access to a website’s server and access its files and databases. Depending on the level of access gained, hackers could steal data, change website content or disrupt online services.
Thousands of Kenyan websites run on PHP, including platforms for public services, education, telecommunications and business.
The ministry instructed institutions to verify which of their systems are affected, apply the official fixes, review system logs, tighten web application firewall rules and access controls, and monitor their systems closely.
“Administrators should verify the applicable fixes and affected versions against official PHP guidance and vendor advisories before deployment,” the ministry said.
It warned that short-term protections are no replacement for proper updates.
“Temporary protective measures should not be treated as a substitute for applying the official security updates,” it said.
Where a public-facing system cannot be secured quickly, institutions have been asked to consider restricting outside access or taking the system offline until the vulnerability is addressed. They have also been told to work with hosting providers and software developers, prioritise the most critical services, and escalate any unresolved high-risk exposures.
The ICT Authority will lead the response across Government.
“The ICT Authority shall coordinate technical guidance and support to Government institutions in identifying potentially affected systems, facilitating remediation and monitoring implementation of the recommended measures,” the ministry said.
- Cyber crimes rise as businesses bet on working remotely
- DDoS attacks on Kenyan websites double to 72 million in a year
The vulnerabilities were made public on Tuesday, October 20, 2026, after researchers using artificial intelligence models discovered them in August. A group of technology companies and security researchers then spent about two months preparing fixes.
“Over the past two months, we led a coalition of maintainers, researchers, and security providers to address critical vulnerabilities in PHP,” OpenAI said in a statement.
PHP released the security updates on Wednesday and urged users to install them immediately.
“If you run PHP, it is imperative that you update now,” the PHP Foundation said.
International security agencies have issued similar warnings. The US National Security Agency (NSA) said the flaws could give attackers a direct route to a server’s file system or database.
“If an immediate update is not feasible, it is recommended that organisations take the system offline until it can be fully mitigated,” the NSA said.
The UK’s National Cyber Security Centre also urged organisations to act immediately. Web security firm Cloudflare said it had deployed protective firewall rules before the flaws were made public, while WordPress advised users to fix the underlying PHP problem rather than rely only on WordPress updates.
Several countries have taken government websites offline as a precaution. In the Netherlands, government agencies, political parties and hospitals temporarily shut down public-facing sites. France closed some prefecture websites while waiting for fixes, and Finland’s state IT centre suspended public web services.
Belgium’s foreign ministry took its websites offline after reports of attacks exploiting the flaws, though authorities said no attacks had been recorded on Belgian government sites. The Czech government also took its website down to install updates.
