Government websites in Kenya could be restricted or temporarily taken offline after the State Department for ICT and the Digital Economy and the ICT Authority warned of critical PHP vulnerabilities that could expose affected systems to remote code execution.
PHP is a programming language widely used to power websites and web applications.
The advisory, dated October 21, 2026, warned all Ministries, Departments and Agencies (MDAs) that two critical PHP vulnerabilities had been identified and could expose affected systems to remote code execution.
“Given the widespread use of PHP in web-based systems, these vulnerabilities may pose a significant risk to the confidentiality, integrity and availability of Government information systems and online public services,” the advisory stated.
The vulnerabilities were each rated CVSS 9.2, indicating a critical level of risk.
According to the advisory, government institutions were instructed to identify websites, servers and applications running PHP, particularly internet-facing systems and critical digital services.
Institutions were also asked to establish whether third-party applications, hosting platforms and managed services under their responsibility use vulnerable PHP components.
The ICT Authority and the State Department for ICT and the Digital Economy said the PHP security team had scheduled security updates for release on October 21, 2026.
Administrators were advised to verify applicable fixes and affected versions through official PHP security announcements and vendor advisories before deployment.
Government Websites Taken Offline
The warning came as several countries temporarily shut down websites and online services while applying security patches for the vulnerabilities.
Also Read: TVETA Appoints New Director General
According to Reuters, organisations across Europe took government, school, and hospital websites offline as they moved to protect themselves from the PHP flaws.
Cybersecurity agencies advised organisations unable to apply fixes in time to consider taking affected websites offline.
France temporarily shut down prefecture websites, which serve as local administrative offices, while awaiting security fixes. Belgium’s foreign ministry also took its websites offline following reports of attacks exploiting the vulnerabilities, although authorities said no attacks had been recorded on Belgian government websites.
In the Netherlands, government agencies, political parties, hospitals, and other institutions temporarily took public-facing websites offline.
Finland’s state IT centre Valtori also shut down public web services as a precautionary measure.
The Czech government also took its website offline to implement security updates.
Wikimedia Foundation, which operates Wikipedia, was working to address the PHP vulnerabilities.
Security Measures Ordered
The Kenyan advisory directed institutions to prepare and apply security updates immediately once verified.
“Where an affected internet-facing system cannot be secured promptly, institutions should assess the need to restrict external access or temporarily take the system offline until effective mitigation has been implemented,” the advisory stated.
Government institutions were also directed to review server, application, endpoint and network logs for suspicious activity, unauthorized access attempts and unexpected file modifications.
Also Read: Aliko Dangote Acquires Stake in Kenya Pipeline for Ksh42.5 Billion
Additional measures included strengthening web application firewall rules, reviewing access controls and engaging software developers, hosting providers and service providers to confirm remediation efforts on affected systems.
The advisory further instructed institutions to activate incident response procedures, preserve relevant logs and evidence where compromise was suspected, and report incidents through established government cybersecurity reporting channels.
The ICT Authority said it would coordinate technical guidance and support to help government institutions identify affected systems and implement remediation measures.
All ICT directors and system administrators were directed to prioritize remediation efforts and maintain records of action taken.
At the same time, institutions unable to implement the required measures immediately were instructed to document outstanding risks, compensating controls, and planned remediation timelines while ensuring the protection of government websites, information systems, and digital public services.
Follow our WhatsApp Channel and X Account for real-time news updates.
