Governments across Africa are racing to patch two critical PHP flaws that let attackers seize a web server without a password. The PHP2Shell vulnerability, disclosed on 21 October, reaches government portals, banks, online shops and the WordPress sites that run on the language. Kenya and Ghana have already ordered agencies to act. The harder question is who warns everyone else.
How the PHP2Shell Vulnerability Works
The PHP project released emergency fixes on 21 October for CVE-2026-109618 and CVE-2026-109619. Each scores 9.2 out of 10 on the CVSS v4.0 severity scale. The project says both can allow unauthenticated remote code execution. In plain terms, an attacker can run commands on a server from anywhere.
Wiz Research, which found the flaws, says every version from PHP 5.4 through 8.5.11 is vulnerable. Fixes landed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. CERT-EU notes that PHP 8.1 and older no longer receive official updates. Operators on those branches must find vendor backports or migrate.
Updating WordPress, Drupal or Magento will not help. The defect sits in the PHP runtime, not in the applications built on top of it. This PHP security flaw is also unusually broad, because it threatens any server that handles web requests with PHP.
Attack Attempts Began Before the Patch
Details leaked on 20 October, a day before the scheduled release, according to Patchstack’s timeline. Cloudflare reported attack attempts on 21 October. Amazon says it saw one as early as 17 October, CIO Africa reports. CISA said at the time of its alert that it had not observed exploitation of these flaws.
Those accounts differ, and none shows an attack succeeding against an African target. The disclosure still raises an accountability question. The PHP Foundation acknowledged an early signal of one flaw in 2024, TechTrendsKE reports, and called the delay a structural failure.
Kenya and Ghana Order Government Agencies to Patch
Kenya’s State Department for ICT and the ICT Authority issued a critical advisory on 21 October. It tells ministries and agencies to find every PHP system they run, including those managed by outside hosts, and to prioritise internet-facing ones. Agencies that cannot patch must restrict access or take the system offline. They must also document the residual risk and a remediation timeline.
Ghana moved the same way. The Cyber Security Authority, which licensed a record 51 cybersecurity providers in 2024, joined the National Information Technology Agency, which Ghana’s communications ministry said in 2025 would become a regulator, in a public alert. Government institutions have seven days to remediate and report back, according to Adom Online. The agencies warned that updating themes or plugins alone will not close the hole.
The African Websites No Advisory Reaches
CIO Africa points to the gap. Much of Africa’s web runs on PHP outside government, it notes, from SME online shops to NGO sites, private schools, saccos, local media and churches. Many sit on cheap shared hosting. Many were built by freelancers who have since moved on.
Kenya’s advisory targets government. Institutions are required to “treat this advisory as urgent,” it says. Private site owners get no such instruction.
Hosting providers may close part of that gap. US-based InMotion Hosting says it applied PHP’s recommended temporary fix across every server it manages. TechMoonshot had not found a comparable public statement from an African host by 22 October. Experts also fear that millions of PHP sites run ancient versions that likely cannot be updated, The Record reports.
What Nigerian Site Owners Face
Nigeria’s picture is less clear. BusinessDay has published guidance urging site owners to confirm their PHP version and apply the fixes. TechMoonshot did not find a Nigerian government advisory in public sources by 22 October. NITDA has issued warnings before, including a 2024 alert on a LiteSpeed Cache plugin flaw, but that bug lived in a plugin rather than the runtime.
The stakes are legal as well as technical. A compromised server that leaks customer data triggers breach-notification duties under the Nigeria Data Protection Act. Profiled Nigeria says those duties include notifying the regulator within 72 hours. That regulator has collected ₦7.2 billion in penalties and completed 246 breach investigations, TechMoonshot reported in February.
What Comes Next for African Site Owners
Site owners should ask their host or developer one question today. Which PHP version does my server run, and is it patched? A WordPress update will not answer it.
Watch whether other national response teams follow Kenya and Ghana, and whether regional hosts commit to patching client servers. The PHP2Shell vulnerability will test Africa’s warning systems as much as its servers. Governments reacted within a day. The small businesses that carry much of the continent’s e-commerce may not have heard.
