The Ministry of Information, Communications and the Digital Economy has directed all government institutions to urgently strengthen the security of their websites and digital applications following the discovery of critical vulnerabilities in PHP, a programming language used by an estimated 70 per cent of websites worldwide.  

The vulnerabilities, reportedly uncovered by cybersecurity researchers using artificial intelligence (AI) tools, have raised concerns about potential cyberattacks, unauthorised access to sensitive information and disruptions to digital services. The reported security flaws, dubbed PHP2SHELL, have been assigned a severity rating of 9.2 out of 10.  

In a Wednesday advisory, the Ministry instructed government institutions to identify vulnerable systems, strengthen web application firewalls, review access controls and enhance security monitoring. Institutions were also urged to coordinate with hosting providers and software developers to address potential risks.  

The Ministry emphasised that temporary protective measures should not replace official security updates, scheduled for release on 21 October 2026. Administrators were advised to verify which PHP versions were affected and the recommended fixes before deployment.  

The ICT Authority will coordinate technical support, guide institutions in identifying affected systems, and monitor the implementation of security measures. Institutions must prioritise high-risk vulnerabilities and escalate unresolved security threats via appropriate channels. The directive aims to safeguard government information systems, protect sensitive data, and ensure the continued delivery of online public services.  

(Source: Citizen)