Ghana Warns of Critical PHP Vulnerabilities Threatening Websites and Servers

Ghana’s Cyber Security Authority (CSA)  and the National Information Technology Agency (NITA)  have issued a joint cybersecurity alert warning government institutions, businesses, website owners, hosting providers and operators of Critical Information Infrastructure about two serious vulnerabilities affecting PHP, a programming language widely used to power websites and online services. The alert was issued in Accra on October 22, 2026.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619 and collectively referred to as “PHP2Shell,” could allow attackers to take control of affected servers without authentication. Successful exploitation could expose sensitive information, disrupt online services and provide attackers with an entry point into an organisation’s wider network.

The PHP Project has released security fixes in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The two agencies have urged affected organisations to install the appropriate patched release, upgrade to a later supported version or apply a vendor package confirmed to contain the fixes. They cautioned that updating website themes or plugins alone would not address vulnerabilities in the underlying PHP software.

As part of the response, organisations have been directed to identify all affected websites, applications and servers running PHP, including systems managed by external service providers. Internet-facing platforms and essential public services should receive priority during the assessment and remediation process.

The agencies also advised organisations to install the security updates immediately, restart services where necessary and verify that the patched software is running. Where an immediate update is not possible, affected services should be temporarily taken offline. Temporary protective measures, they stressed, must not be treated as a substitute for installing the fixes.

Organisations have further been instructed to investigate potential signs of compromise, including unusual log entries or processes, unexpected administrator accounts and unauthorised changes to website files. Suspected systems should be isolated and relevant evidence preserved. Website owners are also expected to obtain written confirmation from hosting providers, developers and system administrators that affected systems have been identified and patched.

For government institutions, the alert places responsibility on institutional heads to ensure that ICT teams and service providers respond urgently. NITA will coordinate technical support for government digital assets and services, while the CSA will oversee incident reporting and response. Government institutions are also expected to maintain up-to-date inventories of digital assets and nominate responsible officers in line with NITA’s Government Digital Assurance Programme (GovDAP).

All government agencies have been given seven days to implement the required measures and report their remedial actions to the CSA and NITA.

The public has also been warned against fraudulent messages claiming to offer a “PHP security update” and requesting that recipients download files, disclose passwords or provide payment details. Website owners have been advised to obtain security updates only from official software sources or verified service providers.

Organisations and individuals who suspect a compromise or cybersecurity incident can contact the CSA by calling or sending an SMS to 292, or by emailing report@csa.gov.gh. Government institutions seeking digital services coordination or GovDAP support can contact NITA at govdap@nita.gov.gh or call 055 249 9661.

The alert, referenced as CSA/COMMS/PR/2026-10/02, directs technical teams to the PHP Project’s security releases page at php.net/archive/2026.php. The agencies have urged all affected organisations to treat the vulnerabilities as an urgent security matter and take immediate action.