CSA and NITA give government agencies seven days to fix PHP flaws

The Cyber Security Authority (CSA), in collaboration with the National Information Technology Agency (NITA), has directed government institutions to fix critical security vulnerabilities in PHP software within seven days, warning that failure to act could expose their digital systems to cyberattacks.

In a joint cybersecurity alert issued in Accra on Thursday, October 22, 2026, the two agencies said the vulnerabilities could allow attackers to take control of affected servers without a username or password, putting sensitive data and online services at risk.

The warning also has implications for businesses that rely on websites, online platforms and digital systems to serve customers, process transactions and manage information.

'Nigeria offers faster business growth than Ghana' – Chicken Republic CEO

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619 and commonly known as “PHP2Shell”, could expose confidential information, disrupt business operations and enable attackers to move into other parts of an organisation’s network.

“Successful exploitation could expose sensitive information, disrupt services and enable further attacks against an organisation’s network,” the alert stated.

The agencies have urged affected organisations to install security updates released by the PHP Project. The fixes are available in PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12, as well as later supported releases or vendor packages confirmed to contain the fixes.

“Updating website themes or plugins alone does not resolve vulnerabilities in the underlying PHP software,” the alert warned, urging businesses and website owners to ensure that the core software powering their platforms is properly secured.

For businesses, a successful attack could result in service interruptions, the exposure of customer information and additional costs associated with investigating and restoring affected systems.

The agencies have therefore advised organisations to prioritise internet-facing systems and essential digital services when applying the updates.

Meanwhile, affected organisations have been advised to temporarily take vulnerable services offline until they can be secured.

“Temporary protective measures should not replace patching,” the alert stated, stressing that organisations must address the underlying software weaknesses rather than rely solely on short-term security measures.

The directive also places responsibility on government institutions to ensure that their technology teams and external service providers act promptly.

NITA will coordinate technical support for government digital services, while the CSA will lead cybersecurity incident reporting and response.

“All government institutions must act within the next seven (7) days and report remedial actions taken to the CSA and NITA,” the agencies stated.

The alert also cautioned the public against suspicious messages asking users to download a “PHP security update”, disclose passwords or provide payment details. Businesses have been advised to obtain software updates only from official sources or verified service providers.

Organisations that suspect a breach can contact the CSA by calling or sending an SMS to 292, or by emailing report@csa.gov.gh.

Government institutions seeking support with digital services and the Government Digital Assurance Programme can contact NITA at govdap@nita.gov.gh or on 055 249 9661.

ANAS/MA

How a Visit to GHACEM Inspired Ibrahim Mahama to Build Dzata Cement