The Cyber Security Authority (CSA) and the National Information Technology Agency (NITA) have issued a joint public alert over two critical vulnerabilities in PHP, a programming language widely used to run websites and online services in Ghana.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619 and commonly referred to as "PHP2Shell," could allow attackers to take control of affected servers without a username or password. Successful exploitation could expose sensitive information, disrupt services and enable further attacks against an organisation's network.
The alert targets government institutions, businesses, website owners, hosting providers and operators of critical information infrastructure.
Security updates available
The agencies said the PHP Project had released fixes in PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Organisations have been directed to immediately install the appropriate fixed release, a later supported release, or a vendor package confirmed to contain the fixes.
The authorities cautioned that updating website themes or plugins alone would not resolve vulnerabilities in the underlying PHP software.
Immediate actions
The agencies outlined five immediate steps for affected organisations. These include identifying all websites, web applications and servers using PHP, including those managed by external providers, and prioritising internet-facing systems and essential public services.
Organisations are to apply security updates immediately, following vendor instructions, restarting affected services where required and verifying that the patched software is running. Where an immediate update is not feasible, unpatched services should be taken offline temporarily until they can be secured.
The agencies also directed organisations to check for compromise by reviewing logs, unusual processes, unexpected administrator accounts and unauthorised changes to website files, and to isolate suspected compromised systems and preserve evidence. They must also obtain written confirmation from hosting providers, developers and system administrators that affected systems have been identified and patched.
7-Day deadline for government institutions
Heads of government institutions have been directed to ensure that their ICT teams and service providers act urgently. NITA will coordinate technical support for government digital assets and services, while the CSA will coordinate cybersecurity incident reporting and response.
Institutions are to maintain an updated inventory of their digital assets and nominate responsible officers to support remediation and coordination, consistent with NITA's Government Digital Assurance Programme.
All government institutions must act within the next seven days and report remedial actions taken to the CSA and NITA.
Advice to the public
The public has been urged to be cautious of messages asking them to download a "PHP security update," disclose passwords or provide payment details. Website owners should obtain updates through official software sources or verified service providers.
Cybersecurity incidents or suspected compromises can be reported to the CSA by calling or sending an SMS to 292, or by email at
The agencies urged all affected organisations to treat the alert as urgent and act immediately.
