The National Information Technology Agency (NITA) and the Cyber Security Authority (CSA) have issued a joint cybersecurity alert warning government institutions, businesses, and website operators in Ghana about two critical vulnerabilities in PHP that could allow attackers to take control of affected servers without login credentials.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619 and commonly referred to as “PHP2Shell”, could expose sensitive information, disrupt online services and enable further attacks on affected organisations’ networks.
In a joint alert issued on Thursday, October 22, 2026, the two institutions urged affected organisations to install security updates immediately to protect their systems.
The PHP Project has released fixes in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Organisations have been advised to install the appropriate fixed version, a later supported release or a vendor package confirmed to contain the fixes.
The agencies cautioned that updating website themes or plugins alone would not address vulnerabilities in the underlying PHP software.
They also outlined immediate steps for affected organisations, including identifying all websites, applications and servers running PHP, prioritising internet-facing systems, installing security updates and checking for signs of compromise.
Organisations that cannot update their systems immediately have been advised to temporarily take affected services offline where necessary.
For government institutions, NITA will coordinate technical support for government digital assets and services, while the CSA will handle cybersecurity incident reporting and response.
The agencies have directed all government institutions to take action within seven days and report the remedial measures taken to both agencies.
The alert also advises the public to be cautious of messages requesting password disclosures, payment details, or downloads of supposed PHP security updates. Website owners have been urged to obtain updates only from official software sources or verified service providers.
Organisations experiencing cybersecurity incidents or suspecting a compromise can contact the CSA by calling or sending an SMS to 292, or by emailing report@csa.gov.gh.
Government institutions seeking technical coordination or enquiries relating to the Government Digital Assurance Programme (GovDAP) can contact NITA at govdap@nita.gov.gh or call 055 249 9661.
The two agencies have urged all affected organisations to treat the vulnerabilities as urgent and take immediate action.
Read the full statement below:
