The Kenyan government has issued a critical cybersecurity advisory to all Ministries, Departments and Agencies (MDAs) following the discovery of two security vulnerabilities that could expose government digital systems to cyberattacks.
The advisory, issued on October 21, 2026, by the Ministry of Information, Communications and the Digital Economy through the State Department for ICT and the Digital Economy, in collaboration with the ICT Authority, warns of vulnerabilities affecting PHP, a programming language widely used to run websites and web applications.
Each vulnerability carries a Common Vulnerability Scoring System (CVSS) score of 9.2, indicating a critical level of risk. According to the PHP security team, the flaws could allow attackers to execute malicious code remotely without authentication on vulnerable systems.
The vulnerabilities pose a potential threat to the confidentiality, integrity and availability of government information systems, including public-facing websites, digital service platforms and other online services.
Under the advisory, government agencies have been directed to identify internet-facing systems, critical digital services, hosting platforms and managed services running affected PHP components.
System administrators are also required to prepare for and promptly apply the relevant security updates, verifying the fixes against official PHP guidance and vendor advisories.
The PHP security team released updates on October 21, 2026, urging users to update affected installations immediately.
The alert comes amid heightened international concern over the vulnerabilities, with cybersecurity agencies urging organisations to prioritise exposed systems and take appropriate protective measures.
