Government institutions have been ordered to address two critical vulnerabilities in PHP software within seven days, warning that attackers could exploit the flaws to take control of affected servers and expose sensitive information.
The Cyber Security Authority (CSA) and the National Information Technology Agency (NITA) issued the joint alert on Oct. 22, identifying the vulnerabilities as CVE-2026-109618 and CVE-2026-109619, also referred to as “PHP2Shell.”
The agencies said successful exploitation could allow attackers to access vulnerable servers without authentication, disrupt online services and move further into an organisation’s network. They urged government institutions, businesses, website owners and hosting providers to install security updates immediately.
The directive requires all government institutions to report remedial actions to the CSA and NITA within seven days. NITA will coordinate technical support for government digital services, while the CSA will oversee cybersecurity incident reporting and response.
The vulnerabilities affect PHP, a programming language widely used to operate websites and online services. The agencies said the PHP Project had released fixes in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Organisations were advised to install the appropriate fixed version, a later supported release or a vendor package confirmed to include the fixes.
The alert warned that updating website themes or plugins alone would not resolve vulnerabilities in the underlying PHP software.
Organisations that cannot immediately patch affected systems should temporarily take vulnerable services offline where necessary, the agencies said. They also advised operators to inspect server logs, check for unusual processes and unauthorised changes, and isolate suspected compromised systems while preserving evidence.
The warning highlights the cybersecurity risks facing organisations that rely on online platforms to deliver services and handle sensitive information. A successful attack could disrupt websites and digital services, potentially affecting customers, businesses and public institutions.
The agencies also directed government institutions to maintain an updated inventory of digital assets and to nominate officers responsible for remediation and coordination, in line with NITA’s Government Digital Assurance Programme.
The alert did not disclose evidence that the vulnerabilities had already been exploited in Ghana or identify any affected institutions.
The CSA urged organisations to report cybersecurity incidents or suspected compromises through its hotline at 292 or by email at [email protected] Government institutions seeking coordination support were directed to contact NITA through [email protected].
Website owners are also warned against fraudulent messages requesting that they download purported PHP security updates or disclose passwords and payment information. The agencies advised obtaining patches through official software sources or verified service providers.
